CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 27, 2026
- Updated
- Oct 6, 2026
- Reserved
- Sep 27, 2026
Description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
SyliusSylius |
|
References
- GitHub Security Advisory (GHSA-vv4h-q2x8-74g4)vendor-advisory
- https://github.com/Sylius/Sylius/pull/19216patchissue-tracking
- https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905dpatch
- Sylius v2.2.9 Release Notesrelease-notes
- https://github.com/Sylius/Syliusproduct
- VulnCheck Advisory: Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwritethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.