Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-53638 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:3.1 LOWVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/Sylius/Sylius/security/advisories/GHSA-6955-hrm5-c4qp	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-863	Incorrect Authorization	[email protected]

Affected Products

Product	Versions
Sylius	>= 2.0.0, < 2.0.18 (semver) >= 2.1.0, < 2.1.15 (semver) >= 2.2.0, < 2.2.6 (semver)
CPE cpe:2.3:a:sylius:sylius:::::::: Remediation Upgrade: 2.0.18moderate effort Upgrade: 2.1.15moderate effort Upgrade: 2.2.6moderate effort Workaround:moderate effort Decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in your application: 1. Create the decorator: ```php <?php declare(strict_types=1); namespace App\Decorator; use ApiPlatform\Validator\Exception\ValidationException; use Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface; use Sylius\Component\Core\Model\OrderInterface; use Sylius\Component\Core\Model\PaymentMethodInterface; use Sylius\Component\Core\Repository\PaymentMethodRepositoryInterface; use Sylius\Component\Core\Repository\PaymentRepositoryInterface; use Sylius\Component\Payment\Resolver\PaymentMethodsResolverInterface; use Symfony\Component\Validator\ConstraintViolation; use Symfony\Component\Validator\ConstraintViolationList; use Symfony\Contracts\Translation\TranslatorInterface; final readonly class ChannelCheckingPaymentMethodChanger implements PaymentMethodChangerInterface { public function __construct( private PaymentMethodChangerInterface $decorated, private PaymentRepositoryInterface $paymentRepository, private PaymentMethodRepositoryInterface $paymentMethodRepository, private PaymentMethodsResolverInterface $paymentMethodsResolver, private TranslatorInterface $translator, ) { } public function changePaymentMethod(string $paymentMethodCode, mixed $paymentId, OrderInterface $order): OrderInterface { /** @var PaymentMethodInterface\|null $paymentMethod */ $paymentMethod = $this->paymentMethodRepository->findOneBy(['code' => $paymentMethodCode]); $payment = $this->paymentRepository->findOneByOrderId($paymentId, $order->getId()); if ( $paymentMethod !== null && $payment !== null && !in_array($paymentMethod, $this->paymentMethodsResolver->getSupportedMethods($payment), true) ) { $template = 'sylius.payment_method.not_available'; $parameters = ['%name%' => (string) $paymentMethod->getName()]; throw new ValidationException(new ConstraintViolationList([ new ConstraintViolation( message: $this->translator->trans($template, $parameters, 'validators'), messageTemplate: $template, parameters: $parameters, root: $paymentMethodCode, propertyPath: '', invalidValue: $paymentMethodCode, ), ])); } return $this->decorated->changePaymentMethod($paymentMethodCode, $paymentId, $order); } } ``` 2. Register the decorator in `config/services.yaml`: ```yaml services: App\Decorator\ChannelCheckingPaymentMethodChanger: decorates: sylius_api.changer.payment_method arguments: - '@.inner' - '@sylius.repository.payment' - '@sylius.repository.payment_method' - '@sylius.resolver.payment_methods' - '@translator' ``` 3. Clear the cache: ```shell bin/console cache:clear ```

Product

Versions

Sylius

>= 2.0.0, < 2.0.18 (semver)

>= 2.1.0, < 2.1.15 (semver)

>= 2.2.0, < 2.2.6 (semver)

CPE

cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*

Remediation

Upgrade: 2.0.18moderate effort
Upgrade: 2.1.15moderate effort
Upgrade: 2.2.6moderate effort
Workaround:moderate effort
Decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in your application: 1. Create the decorator: ```php <?php declare(strict_types=1); namespace App\Decorator; use ApiPlatform\Validator\Exception\ValidationException; use Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface; use Sylius\Component\Core\Model\OrderInterface; use Sylius\Component\Core\Model\PaymentMethodInterface; use Sylius\Component\Core\Repository\PaymentMethodRepositoryInterface; use Sylius\Component\Core\Repository\PaymentRepositoryInterface; use Sylius\Component\Payment\Resolver\PaymentMethodsResolverInterface; use Symfony\Component\Validator\ConstraintViolation; use Symfony\Component\Validator\ConstraintViolationList; use Symfony\Contracts\Translation\TranslatorInterface; final readonly class ChannelCheckingPaymentMethodChanger implements PaymentMethodChangerInterface { public function __construct( private PaymentMethodChangerInterface $decorated, private PaymentRepositoryInterface $paymentRepository, private PaymentMethodRepositoryInterface $paymentMethodRepository, private PaymentMethodsResolverInterface $paymentMethodsResolver, private TranslatorInterface $translator, ) { } public function changePaymentMethod(string $paymentMethodCode, mixed $paymentId, OrderInterface $order): OrderInterface { /** @var PaymentMethodInterface|null $paymentMethod */ $paymentMethod = $this->paymentMethodRepository->findOneBy(['code' => $paymentMethodCode]); $payment = $this->paymentRepository->findOneByOrderId($paymentId, $order->getId()); if ( $paymentMethod !== null && $payment !== null && !in_array($paymentMethod, $this->paymentMethodsResolver->getSupportedMethods($payment), true) ) { $template = 'sylius.payment_method.not_available'; $parameters = ['%name%' => (string) $paymentMethod->getName()]; throw new ValidationException(new ConstraintViolationList([ new ConstraintViolation( message: $this->translator->trans($template, $parameters, 'validators'), messageTemplate: $template, parameters: $parameters, root: $paymentMethodCode, propertyPath: '', invalidValue: $paymentMethodCode, ), ])); } return $this->decorated->changePaymentMethod($paymentMethodCode, $paymentId, $order); } } ``` 2. Register the decorator in `config/services.yaml`: ```yaml services: App\Decorator\ChannelCheckingPaymentMethodChanger: decorates: sylius_api.changer.payment_method arguments: - '@.inner' - '@sylius.repository.payment' - '@sylius.repository.payment_method' - '@sylius.resolver.payment_methods' - '@translator' ``` 3. Clear the cache: ```shell bin/console cache:clear ```

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 14, 2026	CVE Modified	CISA-ADP
Sep 8, 2026	New CVE Received	[email protected]