CVE-2026-108724: Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-11 · updated 2026-10-16
Weakness: CWE-639

Description

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.

Affected products

Sylius: through 2.3.0

References

https://github.com/Sylius/Sylius
https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Doctrine/ORM/QueryExtension/Shop/ProductReview/AcceptedExtension.php#L25-L59
https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Resources/config/services/extensions.php#L63-L67
https://hackmd.io/@haind/sylius-shop-product-review-item-moderation-bypass
https://www.vulncheck.com/advisories/sylius-through-2.3.0-authorization-bypass-via-shop-api-product-review-endpoint

Get alerted when CVE-2026-108724 or the next vulnerability affects your stack