CVE-2026-108724 Details

A vulnerability allowing authorization bypass has been identified in Sylius versions through 2.3.0. This issue arises because the 'AcceptedExtension' filter, which ensures that only moderated product reviews are visible, is not applied to the item operation of the product review API. As a result, unauthenticated attackers can access unmoderated and rejected product reviews by enumerating sequential IDs on the 'GET /api/v2/shop/product-reviews/{id}' endpoint. The retrieved reviews include titles, ratings, comments, timestamps, and the first names of the authors, thereby bypassing the moderation process enforced by merchants.

The 'AcceptedExtension' should be modified to apply the accepted status filter to both collection and item operations for product reviews. Additionally, a functional test should be added to ensure that the item endpoint correctly enforces the moderation status, returning a 404 error for non-accepted reviews.