Email verification bypass in Sylius
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting, Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-862.
Summary
In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one). The issue has been patched in Sylius 1.6.9, 1.7.9 and 1.8.3. As a workaround, you may resolve this issue on your own by creating a custom event listener, which will listen to the sylius.customer.pre_update event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain /admin prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event here.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sylius | Sylius | 9.0.0 to before 9.4.4 | 9.4.4 | Patch available | CNA |
| — | sylius/sylius (Packagist) | 1.7.0 to before 1.7.9 | 1.7.9 | Patch available | GHSA-6gw4-x63h-5499 |
| — | sylius/sylius (Packagist) | 1.8.0 to before 1.8.3 | 1.8.3 | Patch available | GHSA-6gw4-x63h-5499 |
| — | sylius/sylius (Packagist) | 1.0.0 to before 1.6.9 | 1.6.9 | Patch available | GHSA-6gw4-x63h-5499 |
- Sylius VendorSylius Affected 9.0.0 to before 9.4.4 Fixed in 9.4.4 Patch available CNA
- sylius/sylius (Packagist) Vendor— Affected 1.7.0 to before 1.7.9 Fixed in 1.7.9 Patch available GHSA-6gw4-x63h-5499
- sylius/sylius (Packagist) Vendor— Affected 1.8.0 to before 1.8.3 Fixed in 1.8.3 Patch available GHSA-6gw4-x63h-5499
- sylius/sylius (Packagist) Vendor— Affected 1.0.0 to before 1.6.9 Fixed in 1.6.9 Patch available GHSA-6gw4-x63h-5499
Remediation
- Fix · CNA Sylius (Sylius) Fixed in 9.4.4
- Fix · GHSA-6gw4-x63h-5499 sylius/sylius (Packagist) Fixed in 1.7.9 Advisory →
- Fix · GHSA-6gw4-x63h-5499 sylius/sylius (Packagist) Fixed in 1.8.3 Advisory →
- Fix · GHSA-6gw4-x63h-5499 sylius/sylius (Packagist) Fixed in 1.6.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15245
- 2026-10-03 Alias added: GHSA-6gw4-x63h-5499
- 2026-10-30 EPSS moved to the 50th–90th percentile
References
Advisory 2
More Sylius vulnerabilities
- TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
- TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
- TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
- TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
- TI-2022-08563 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CVSS 3.1MEDIUM 6.1
- TI-2026-24377 Sylius has a Promotion Usage Limit Bypass via Race Condition CVSS 3.1HIGH 8.2
Sources
- CVE-2020-15245 · CVE Program
- CVE-2020-15245 · NVD
- FIRST EPSS
- GHSA-6gw4-x63h-5499 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences