Sylius Mollie Plugin: Payment status forgery via the payment webhook
Priority MEDIUM 40CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00681 52nd percentileScored 2026-11-07
Fix Fixed MolliePlugin (Sylius): 2.2.8, 3.2.4, 3.3.1sylius/mollie-plugin (Packagist): 2.2.8, 3.2.4, 3.3.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sylius | MolliePlugin | before 2.2.8; 3.0.0 to before 3.2.4; 3.3.0 to before 3.3.1 | 2.2.8, 3.2.4, 3.3.1 | Patch available | CNA |
| — | sylius/mollie-plugin (Packagist) | before 2.2.8 | 2.2.8 | Patch available | GHSA-rc52-c4hv-w89p |
| — | sylius/mollie-plugin (Packagist) | 3.0.0 to before 3.2.4 | 3.2.4 | Patch available | GHSA-rc52-c4hv-w89p |
| — | sylius/mollie-plugin (Packagist) | 3.3.0 to before 3.3.1 | 3.3.1 | Patch available | GHSA-rc52-c4hv-w89p |
- MolliePlugin VendorSylius Affected before 2.2.8; 3.0.0 to before 3.2.4; 3.3.0 to before 3.3.1 Fixed in 2.2.8, 3.2.4, 3.3.1 Patch available CNA
- sylius/mollie-plugin (Packagist) Vendor— Affected before 2.2.8 Fixed in 2.2.8 Patch available GHSA-rc52-c4hv-w89p
- sylius/mollie-plugin (Packagist) Vendor— Affected 3.0.0 to before 3.2.4 Fixed in 3.2.4 Patch available GHSA-rc52-c4hv-w89p
- sylius/mollie-plugin (Packagist) Vendor— Affected 3.3.0 to before 3.3.1 Fixed in 3.3.1 Patch available GHSA-rc52-c4hv-w89p
Remediation
- Fix · CNA MolliePlugin (Sylius) Fixed in 2.2.8, 3.2.4, 3.3.1
- Fix · GHSA-rc52-c4hv-w89p sylius/mollie-plugin (Packagist) Fixed in 2.2.8 Advisory →
- Fix · GHSA-rc52-c4hv-w89p sylius/mollie-plugin (Packagist) Fixed in 3.2.4 Advisory →
- Fix · GHSA-rc52-c4hv-w89p sylius/mollie-plugin (Packagist) Fixed in 3.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-68500
- 2026-10-03 Alias added: GHSA-rc52-c4hv-w89p
References
Other 11
- https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-rc52-c4hv-w89p
- https://github.com/Sylius/MolliePlugin/pull/351
- https://github.com/Sylius/MolliePlugin/pull/352
- https://github.com/Sylius/MolliePlugin/pull/354
- https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49
- https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267
- https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a
- https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8
- https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4
- https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1
- https://github.com/Sylius/MolliePlugin
More Sylius vulnerabilities
- TI-2026-65010 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite CVSS 4.0HIGH 8.7
- TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
- TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
- TI-2026-48275 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII CVSS 3.1MEDIUM 6.5
- TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
- TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
Sources
- CVE-2026-68500 · CVE Program
- CVE-2026-68500 · NVD
- FIRST EPSS
- GHSA-rc52-c4hv-w89p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences