Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-53637 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CNA: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-672	Operation on a Resource after Expiration or Release	[email protected]
CWE-841	Improper Enforcement of Behavioral Workflow	[email protected]

Affected Products

Product	Versions
Sylius	>= 2.0.0, < 2.0.18 (semver) >= 2.1.0, < 2.1.15 (semver) >= 2.2.0, < 2.2.6 (semver)
CPE cpe:2.3:a:sylius:sylius:::::::: Remediation Upgrade: 2.0.18moderate effort Upgrade: 2.1.15moderate effort Upgrade: 2.2.6moderate effort Workaround:moderate effort Create a patched copy of the affected class in your application's `src/` directory and override the Sylius service definition to use it: 1. Create `src/Twig/Component/Cart/FormComponent.php` with the provided code. 2. Override the Sylius service in `config/services.yaml`: ```yaml services: sylius_shop.twig.component.cart.form: class: App\Twig\Component\Cart\FormComponent arguments: - '@sylius.repository.order' - '@form.factory' - '%sylius.model.order.class%' - 'Sylius\Bundle\ShopBundle\Form\Type\CartType' - '@doctrine.orm.entity_manager' - '@event_dispatcher' calls: - [setLiveResponder, ['@ux.live_component.live_responder']] tags: - { name: sylius.live_component.shop, key: 'sylius_shop:cart:form' } ``` 3. Clear the cache with `bin/console cache:clear`.

Product

Versions

Sylius

>= 2.0.0, < 2.0.18 (semver)

>= 2.1.0, < 2.1.15 (semver)

>= 2.2.0, < 2.2.6 (semver)

CPE

cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*

Remediation

Upgrade: 2.0.18moderate effort
Upgrade: 2.1.15moderate effort
Upgrade: 2.2.6moderate effort
Workaround:moderate effort
Create a patched copy of the affected class in your application's `src/` directory and override the Sylius service definition to use it: 1. Create `src/Twig/Component/Cart/FormComponent.php` with the provided code. 2. Override the Sylius service in `config/services.yaml`: ```yaml services: sylius_shop.twig.component.cart.form: class: App\Twig\Component\Cart\FormComponent arguments: - '@sylius.repository.order' - '@form.factory' - '%sylius.model.order.class%' - 'Sylius\Bundle\ShopBundle\Form\Type\CartType' - '@doctrine.orm.entity_manager' - '@event_dispatcher' calls: - [setLiveResponder, ['@ux.live_component.live_responder']] tags: - { name: sylius.live_component.shop, key: 'sylius_shop:cart:form' } ``` 3. Clear the cache with `bin/console cache:clear`.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 9, 2026	CVE Modified	CISA-ADP
Sep 8, 2026	New CVE Received	[email protected]