High severity · published Sep 27, 2026
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sylius · Sylius
2.0.0 before 2.1.16; 2.2.0 before 2.2.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100872
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100872
vendor-advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4
patch
https://github.com/Sylius/Sylius/pull/19216
patch
https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905d
release-notes
https://github.com/Sylius/Sylius/releases/tag/v2.2.9
product
https://github.com/Sylius/Sylius
third-party-advisory
https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-payment-amount-overwrite
More from Sylius
8.8
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
8.8
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
8.2
CVE-2022-24743
Sylius is an open source eCommerce platform
7.5
CVE-2024-57610
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account…
6.5
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion of an already-completed order