Sylius Mollie Plugin up to 2.2.7/3.2.3/3.3.0 id/orderId privileges management

Summaryinfo

A vulnerability was found in Sylius Mollie Plugin up to 2.2.7/3.2.3/3.3.0. It has been rated as problematic. The affected element is an unknown function. Performing a manipulation of the argument id/orderId results in privileges management. This vulnerability is identified as CVE-2026-68500. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Sylius Mollie Plugin up to 2.2.7/3.2.3/3.3.0. This affects an unknown function. The manipulation of the argument id/orderId with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on integrity. The summary by CVE is:

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-68500 since 07/30/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 2.2.8, 3.2.4 or 3.3.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Sylius

Name

• Mollie Plugin

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 3.0
• 3.1
• 3.2
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion