CVE-2026-68501 in MolliePlugin
Summary
by MITRE • 07/31/2026
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
The Sylius Mollie Plugin vulnerability represents a critical access control flaw that allows unauthorized users to enumerate order information through sequential ID exposure. This issue affects multiple versions of the plugin across different major branches, specifically impacting versions prior to 2.2.8, 3.2.4, and 3.3.1. The vulnerability stems from insufficient authorization checks in two primary endpoints: the PageRedirectController::thankYouAction and QrCodeAction::fetchQrCodeFromOrder methods. These endpoints accept sequential orderId parameters without verifying ownership or session context, creating a predictable attack surface where malicious actors can systematically probe order identifiers.
The technical implementation of this vulnerability exploits the lack of proper access controls in the plugin's routing and controller logic. When users navigate to the thank-you page or attempt to fetch QR codes, the system retrieves order information based solely on the provided orderId parameter without validating whether the authenticated user has legitimate access to that specific order. This design flaw creates a directory traversal-like scenario where sequential order IDs can be guessed or enumerated, leading to unauthorized data exposure. The vulnerability aligns with CWE-285 Access Control Vulnerability and represents a classic case of insufficient authorization checks in web applications.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable further malicious activities within the payment ecosystem. Attackers can leverage the exposed order token values to access customer personal information including first name, last name, and email addresses through the GET /{_locale}/register-after-checkout/{tokenValue} endpoint. This exposure creates significant privacy risks for customers and may facilitate social engineering attacks, account takeover attempts, or other forms of identity theft. The vulnerability particularly affects e-commerce platforms using Sylius as their core commerce engine, where payment processing and customer data protection are paramount.
From a threat modeling perspective, this vulnerability maps to multiple ATT&CK techniques including T1087 Account Discovery and T1566 Credential Stuffing, as it allows adversaries to gather customer information that could be used for further exploitation. The attack surface is particularly concerning given that the vulnerability affects multiple version branches of the plugin, suggesting a systemic design flaw rather than an isolated incident. Organizations utilizing Sylius Mollie Plugin should immediately implement the available patches (2.2.8, 3.2.4, and 3.3.1) to mitigate this exposure. Additionally, security teams should conduct comprehensive audits of all payment integration endpoints to identify similar authorization gaps that may exist in other third-party plugins or custom implementations within their commerce infrastructure.