CVE-2026-53638 in Sylius
Summary
by MITRE • 09/09/2026
Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within Sylius versions prior to 2.0.18, 2.1.15, and 2.2.6 represents a critical authorization bypass flaw located specifically within the shop account API infrastructure. This issue arises from an inconsistency in how payment method assignments are validated across different endpoints of the application. While the primary checkout endpoint correctly enforces channel-specific constraints by rejecting out-of-channel payment methods with an HTTP 422 Unprocessable Entity response, the parallel endpoint designed for managing user accounts fails to perform this same validation. This discrepancy allows authenticated users to manipulate order states in ways that were not intended by the system administrators, undermining the integrity of the e-commerce workflow and potentially leading to financial discrepancies or operational disruptions.
From a technical perspective, the flaw resides in the PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint. This API route is designed for authenticated shop customers who have placed an order but not yet paid for it, specifically targeting orders with the state STATE_NEW. The core deficiency lies in the absence of a check to verify whether the selected payment method is enabled and available within the specific channel associated with that order. In contrast, the equivalent checkout endpoint performs this validation rigorously. By silently accepting invalid payment methods and returning an HTTP 200 OK status code, the vulnerable endpoint effectively bypasses the business logic constraints imposed by the store operator. This allows a user to assign any globally enabled payment method to their order, regardless of whether that method has been explicitly excluded from the current sales channel or region.
The operational impact of this vulnerability is significant for e-commerce platforms relying on Sylius. An attacker with an authenticated account can exploit this flaw to force transactions through payment gateways that may not be configured for specific channels, potentially leading to failed payments, increased transaction fees if cross-border methods are used inadvertently, or the bypassing of regional restrictions. For instance, a store might exclude high-risk fraud-prone payment methods from certain regions due to compliance requirements; this vulnerability allows users to ignore those exclusions. Furthermore, it disrupts the expected user experience and can cause backend processing errors if downstream systems expect payments only through approved channels. The silent acceptance of these invalid requests also complicates logging and monitoring efforts, as successful HTTP responses mask the underlying policy violation.
This type of flaw is categorized under CWE-284 Improper Access Control, specifically reflecting a failure to enforce proper restrictions on authenticated users within an application logic context. In terms of threat modeling, this aligns with MITRE ATT&CK techniques related to Privilege Escalation or Defense Evasion, where the attacker leverages inconsistent API behavior to bypass intended security controls. The vulnerability highlights the importance of consistent validation logic across all entry points that modify shared resources like orders and payments. It underscores a common architectural pitfall in RESTful APIs where different endpoints handling similar data may have disparate levels of input validation and authorization checks.
To mitigate this risk, organizations running affected versions must upgrade to Sylius 2.0.18, 2.1.15, or 2.2.6 and above, as these releases contain the necessary patches to enforce channel-specific payment method validation on the account API endpoint. For environments where immediate upgrading is not feasible, a recommended workaround involves decorating the Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface service within the application codebase. This allows developers to inject custom logic that replicates the missing validation check, ensuring that any attempt to assign an out-of-channel payment method is rejected before it reaches the persistence layer. Regular security audits of API endpoints are essential to prevent similar inconsistencies in other parts of the e-commerce platform.