What’s Vulnerable › Vulnerabilities

CVE-2026-100869: Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-27 · updated 2026-09-28
• Weakness: CWE-863

Description

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.

Affected products

• Sylius: from 2.0.0 before 2.1.16; from 2.2.0 before 2.2.9 — fixed in 2.1.16, 2.2.9

How to fix

Upgrade to a fixed version: Sylius 2.1.16, 2.2.9. Check the vendor advisory for mitigations.

References

• https://github.com/Sylius/Sylius
• https://github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75d
• https://github.com/Sylius/Sylius/pull/19214
• https://github.com/Sylius/Sylius/releases/tag/v2.2.9
• https://github.com/Sylius/Sylius/security/advisories/GHSA-2rv4-pjmm-7fxf
• https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-arbitrary-payment-action-via-shop-api

Get alerted when CVE-2026-100869 or the next vulnerability affects your stack