CVE-2026-31821 Details
Description
Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer's cart. The endpoint returns the full cart representation in the response (HTTP 201). The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.
A vulnerability in Sylius versions 2.0.0 prior to 2.0.16, 2.1.0 prior to 2.1.12, and 2.2.0 prior to 2.2.3 allows unauthenticated attackers to add items to the carts of registered customers. This issue arises because the POST /api/v2/shop/orders/{tokenValue}/items endpoint fails to verify cart ownership. An attacker who knows a customer's cart tokenValue can add arbitrary items to that cart. The endpoint then returns the full cart representation, including sensitive information such as the customer's email address, cart contents, address data, payment and shipment IDs, order totals, tax breakdown, and checkout state.
Users can update to Sylius versions 2.0.16, 2.1.12, or 2.2.3 and above to address this vulnerability. Additionally, for those who cannot immediately upgrade, a workaround involves adding an ownership check in the AddItemToCartHandler by injecting UserContextInterface and verifying that the current user matches the cart owner before items are added.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sylius/Sylius/security/advisories/GHSA-wjmg-4cq5-m8hg | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sylius sylius | >= 2.0.0, < 2.0.16 >= 2.1.0, < 2.1.12 >= 2.2.0, < 2.2.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |