CVE-2026-100872
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation…
- Risk score
- 51/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as f…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.1.16 or 2.2.9 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
- https://github.com/Sylius/Sylius
- https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905d
- https://github.com/Sylius/Sylius/pull/19216
- https://github.com/Sylius/Sylius/releases/tag/v2.2.9
- https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4
- https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-payment-amount-overwrite
- https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4
Original description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Last activity 27 Sep 2026. Patch Forecast updates every hour.