Medium severity · published Sep 27, 2026
CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sylius · Sylius
2.0.0 before 2.1.16; 2.2.0 before 2.2.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100869
vendor-advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-2rv4-pjmm-7fxf
patch
https://github.com/Sylius/Sylius/pull/19214
patch
https://github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75d
release-notes
https://github.com/Sylius/Sylius/releases/tag/v2.2.9
product
https://github.com/Sylius/Sylius
third-party-advisory
https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-arbitrary-payment-action-via-shop-api
More from Sylius
8.8
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
8.8
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
8.2
CVE-2022-24743
Sylius is an open source eCommerce platform
7.5
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
7.5
CVE-2024-57610
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account…