Read the docs
TI-2026-24374 Aliases CVE-2026-31821GHSA-wjmg-4cq5-m8hg

Sylius is Missing Authorization in API v2 Add Item Endpoint

Priority HIGH 70CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer's cart. The endpoint returns the full cart representation in the response (HTTP 201). The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed Sylius (Sylius): 2.2.3, 2.1.12, 2.0.16sylius/sylius (Packagist): 2.0.16, 2.1.12, 2.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SyliusSylius2.2.0 to before 2.2.3; 2.1.0 to before 2.1.12; 2.0.0 to before 2.0.162.2.3, 2.1.12, 2.0.16Patch availableCNA
—sylius/sylius (Packagist)2.0.0 to before 2.0.162.0.16Patch availableGHSA-wjmg-4cq5-m8hg
—sylius/sylius (Packagist)2.1.0 to before 2.1.122.1.12Patch availableGHSA-wjmg-4cq5-m8hg
—sylius/sylius (Packagist)2.2.0 to before 2.2.32.2.3Patch availableGHSA-wjmg-4cq5-m8hg
  • Sylius VendorSylius Affected 2.2.0 to before 2.2.3; 2.1.0 to before 2.1.12; 2.0.0 to before 2.0.16 Fixed in 2.2.3, 2.1.12, 2.0.16 Patch available CNA
  • sylius/sylius (Packagist) Vendor— Affected 2.0.0 to before 2.0.16 Fixed in 2.0.16 Patch available GHSA-wjmg-4cq5-m8hg
  • sylius/sylius (Packagist) Vendor— Affected 2.1.0 to before 2.1.12 Fixed in 2.1.12 Patch available GHSA-wjmg-4cq5-m8hg
  • sylius/sylius (Packagist) Vendor— Affected 2.2.0 to before 2.2.3 Fixed in 2.2.3 Patch available GHSA-wjmg-4cq5-m8hg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*2.0.0 to before 2.0.16; 2.1.0 to before 2.1.12; 2.2.0 to before 2.2.3VulnerableSylius
  • cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.16; 2.1.0 to before 2.1.12; 2.2.0 to before 2.2.3 Vulnerable ·Sylius

Remediation

  • Fix · CNA Sylius (Sylius) Fixed in 2.2.3, 2.1.12, 2.0.16
  • Fix · GHSA-wjmg-4cq5-m8hg sylius/sylius (Packagist) Fixed in 2.0.16 Advisory →
  • Fix · GHSA-wjmg-4cq5-m8hg sylius/sylius (Packagist) Fixed in 2.1.12 Advisory →
  • Fix · GHSA-wjmg-4cq5-m8hg sylius/sylius (Packagist) Fixed in 2.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31821
  2. 2026-10-03 Alias added: GHSA-wjmg-4cq5-m8hg

References

Advisory 2

Other 1

  • TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
  • TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
  • TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
  • TI-2022-08563 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CVSS 3.1MEDIUM 6.1
  • TI-2026-24377 Sylius has a Promotion Usage Limit Bypass via Race Condition CVSS 3.1HIGH 8.2
  • TI-2024-37963 A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted… CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences