CVE-2026-100872GHSA-vv4h-q2x8-74g4
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Sylius Sylius
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Text from CVE List
Affected versions 2
- Syliusaffected: 2.0.0 before 2.1.16CVE List
- Syliusaffected: 2.2.0 before 2.2.9CVE List
References 6
- github.com/Sylius/Sylius/pull/19216Fixvia CVE List
- github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905dFixvia CVE List
- github.com/Sylius/Sylius/releases/tag/v2.2.9Fixvia CVE List
- vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-payment-amount-overwriteAdvisoryvia CVE List
- github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4Exploitvia CVE List
- github.com/Sylius/SyliusReferencevia CVE List