Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
Priority HIGH 68CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0087 59th percentileScored 2026-11-07
Fix Fixed MolliePlugin (Sylius): 2.2.8, 3.2.4, 3.3.1sylius/mollie-plugin (Packagist): 2.2.8, 3.2.4, 3.3.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sylius | MolliePlugin | before 2.2.8; 3.0.0 to before 3.2.4; 3.3.0 to before 3.3.1 | 2.2.8, 3.2.4, 3.3.1 | Patch available | CNA |
| — | sylius/mollie-plugin (Packagist) | before 2.2.8 | 2.2.8 | Patch available | GHSA-x83g-979r-f5fh |
| — | sylius/mollie-plugin (Packagist) | 3.0.0 to before 3.2.4 | 3.2.4 | Patch available | GHSA-x83g-979r-f5fh |
| — | sylius/mollie-plugin (Packagist) | 3.3.0 to before 3.3.1 | 3.3.1 | Patch available | GHSA-x83g-979r-f5fh |
- MolliePlugin VendorSylius Affected before 2.2.8; 3.0.0 to before 3.2.4; 3.3.0 to before 3.3.1 Fixed in 2.2.8, 3.2.4, 3.3.1 Patch available CNA
- sylius/mollie-plugin (Packagist) Vendor— Affected before 2.2.8 Fixed in 2.2.8 Patch available GHSA-x83g-979r-f5fh
- sylius/mollie-plugin (Packagist) Vendor— Affected 3.0.0 to before 3.2.4 Fixed in 3.2.4 Patch available GHSA-x83g-979r-f5fh
- sylius/mollie-plugin (Packagist) Vendor— Affected 3.3.0 to before 3.3.1 Fixed in 3.3.1 Patch available GHSA-x83g-979r-f5fh
Remediation
- Fix · CNA MolliePlugin (Sylius) Fixed in 2.2.8, 3.2.4, 3.3.1
- Fix · GHSA-x83g-979r-f5fh sylius/mollie-plugin (Packagist) Fixed in 2.2.8 Advisory →
- Fix · GHSA-x83g-979r-f5fh sylius/mollie-plugin (Packagist) Fixed in 3.2.4 Advisory →
- Fix · GHSA-x83g-979r-f5fh sylius/mollie-plugin (Packagist) Fixed in 3.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-68501
- 2026-10-03 Alias added: GHSA-x83g-979r-f5fh
- 2026-10-31 EPSS moved to the 50th–90th percentile
References
Other 11
- https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh
- https://github.com/Sylius/MolliePlugin/pull/351
- https://github.com/Sylius/MolliePlugin/pull/352
- https://github.com/Sylius/MolliePlugin/pull/354
- https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49
- https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267
- https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a
- https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8
- https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4
- https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1
- https://github.com/Sylius/MolliePlugin
More Sylius vulnerabilities
- TI-2026-65010 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite CVSS 4.0HIGH 8.7
- TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
- TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
- TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
- TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
- TI-2022-08563 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-68501 · CVE Program
- CVE-2026-68501 · NVD
- FIRST EPSS
- GHSA-x83g-979r-f5fh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences