CVE-2026-108724 in Sylius
Summary
by MITRE • 10/11/2026
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in Sylius versions through 2.3.0 represents a critical authorization bypass within the REST API layer of the e-commerce platform. This flaw specifically affects the handling of product review data via the item operation endpoint located at GET /api/v2/shop/product-reviews/{id}. The core technical deficiency lies in the configuration of the AcceptedExtension filter, which is designed to restrict access to only those reviews that have been approved by merchants or moderators. In this instance, the filter was not correctly applied to the specific API route for retrieving individual review items. Consequently, the system fails to enforce proper access control checks before returning data, allowing any client making a request to bypass the intended moderation workflow entirely.
From an operational perspective, this misconfiguration enables unauthenticated attackers to retrieve sensitive information that is explicitly meant to be hidden from public view until it passes quality assurance or content moderation processes. By exploiting this flaw, adversaries can enumerate sequential identifiers associated with product reviews and extract detailed metadata including review titles, star ratings, full comment text, timestamps of submission, and the first names of authors who submitted them. This capability transforms a simple data retrieval error into a significant privacy risk, as it exposes user-generated content that merchants have deemed inappropriate or unverified for public display. The ability to systematically iterate through IDs allows attackers to harvest large volumes of potentially sensitive personal information without needing valid credentials or session tokens.
The security implications extend beyond mere data leakage, impacting the integrity and trustworthiness of the e-commerce platform's community features. Merchants rely on moderation systems to filter out spam, hate speech, or legally non-compliant content before it reaches customers. By bypassing this gatekeeping mechanism, attackers can effectively publish unmoderated material publicly through API responses that might be cached by CDNs or indexed by search engines if not properly secured at the infrastructure level. Furthermore, exposing author first names alongside specific review comments creates a risk of doxxing or targeted harassment against users who submitted reviews under the assumption their identity would remain partially obscured until approval. This undermines user trust and exposes the organization to potential legal liabilities regarding data protection regulations such as GDPR if personal identifiable information is exposed without consent.
In terms of industry standard classifications, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure in authorization logic where access control decisions are not enforced for specific API endpoints. It also maps to MITRE ATT&CK technique T1078 Valid Accounts if the attacker were using compromised credentials, but since it is unauthenticated, it falls under general unauthorized access patterns often associated with broken object level permissions (BOLA) when sequential IDs are used to enumerate resources. The use of predictable identifiers facilitates enumeration attacks, which are categorized under reconnaissance activities in threat modeling frameworks.
To mitigate this vulnerability, Sylius users must apply the official security patches released for versions 2.3.1 and later, which correct the configuration of the AcceptedExtension filter on the product reviews item operation. Administrators should ensure that all API endpoints handling user-generated content strictly enforce authorization checks regardless of authentication status where appropriate. Additionally, implementing rate limiting on the affected endpoint can reduce the efficiency of enumeration attacks while patches are being deployed. It is also advisable to audit other similar API routes for consistent application of security extensions and filters to prevent analogous bypasses in different modules of the platform. Regular penetration testing focusing on authorization logic across all REST endpoints will help identify such misconfigurations before they can be exploited by malicious actors seeking to harvest sensitive data or disrupt service integrity.