🚨 CVE-2026-100872
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
🎖@cveNotify
GitHub
GitHub - Sylius/Sylius: Headless open-source eCommerce platform on top of PHP/Symfony/API Platform
Headless open-source eCommerce platform on top of PHP/Symfony/API Platform - Sylius/Sylius
September 27, 2026 103
