CVE-2026-100872: Sylius Auth Bypass Vulnerability

CVE-2026-100872 Overview

CVE-2026-100872 is a payment amount tampering vulnerability in Sylius, an open-source e-commerce platform built on Symfony. Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation. Unauthenticated attackers can modify order totals after a gateway transaction has already been initiated. An attacker pays a small amount, enlarges the order after the gateway captures the funds, and the system marks the inflated order as fully paid. The gateway only captured the original, lower amount, leaving the merchant to fulfill goods that were never fully paid for. The weakness is classified under [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact

Unauthenticated attackers can obtain merchandise at a fraction of its price by manipulating order totals after payment capture, causing direct financial loss to merchants running affected Sylius storefronts.

Affected Products

• Sylius versions prior to 2.1.16
• Sylius versions prior to 2.2.9 in the 2.2 branch
• Sylius-based commerce storefronts with gateway-integrated payment flows

Discovery Timeline

• 2026-09-27 - CVE-2026-100872 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100872

Vulnerability Analysis

The flaw resides in the Sylius order payment processing pipeline, specifically in OrderPaymentProcessor. When a cart is recalculated, the processor updates the associated payment amount to match the new order total. The processor did not check whether a gateway transaction was already in progress or completed for that payment. An attacker could therefore initiate a payment for a small cart, allow the gateway to capture the funds, and then enlarge the cart. The payment record would be updated to reflect the new, larger total while the gateway only ever received the original, smaller charge. The resulting order state treats the inflated total as paid.

Root Cause

The root cause is missing verification of payment state authenticity during order recalculation. Sylius did not distinguish between payments that were still in a mutable state (STATE_NEW, STATE_FAILED, STATE_CANCELLED) and those that had been claimed by a gateway through ACTION_CAPTURE or ACTION_AUTHORIZE payment requests. Any subsequent cart modification would overwrite the stored amount without checking gateway claim status.

Attack Vector

The attack is network-reachable and requires no authentication or user interaction. An attacker performs the following sequence against a vulnerable storefront:

1. Add an inexpensive item to the cart and proceed to checkout.
2. Initiate payment and allow the gateway to capture the small amount.
3. Modify the cart to add high-value items, triggering order recalculation.
4. Complete the checkout flow; the order is marked fully paid while the gateway only holds the original lower amount.

The fix introduces a ClaimedByGatewayCheckerTrait that inspects payment request state before permitting amount changes:

<?php

namespace Sylius\Component\Core\Payment;

use Sylius\Component\Payment\Model\PaymentInterface;
use Sylius\Component\Payment\Model\PaymentRequestInterface;

trait ClaimedByGatewayCheckerTrait
{
    private function isClaimedByGateway(PaymentInterface $payment): bool
    {
        $claimingActions = [PaymentRequestInterface::ACTION_CAPTURE, PaymentRequestInterface::ACTION_AUTHORIZE];
        $nonClaimingStates = [
            PaymentRequestInterface::STATE_NEW,
            PaymentRequestInterface::STATE_FAILED,
            PaymentRequestInterface::STATE_CANCELLED,
        ];

        $claimingPaymentRequests = $payment->getPaymentRequests()->filter(
        // ... filtering logic
        );
    }
}

Source: Sylius Commit 9e9aeaa

Detection Methods for CVE-2026-100872

Indicators of Compromise

• Orders in the paid state where the sum of gateway-captured amounts is less than the order total recorded in the Sylius database.
• Multiple cart modification events on the same order between a gateway CAPTURE action and the final order completion event.
• Reconciliation discrepancies between the payment gateway's settlement reports and Sylius order totals.
• Shipment or fulfillment requests tied to orders with mismatched captured and recorded amounts.

Detection Strategies

• Reconcile Sylius sylius_payment records against gateway transaction logs daily, flagging any payment where amount exceeds the gateway-captured value.
• Add database-level audit triggers on the sylius_order and sylius_payment tables to log any total or amount change occurring after a payment transitions to a captured state.
• Review application logs for repeated calls to the cart recalculation endpoint from the same session following a payment capture event.

Monitoring Recommendations

• Centralize Sylius application and web server logs and alert on cart modification events that occur after a successful gateway callback for the same order ID.
• Monitor payment gateway webhooks for capture.completed events and correlate them with subsequent order total changes in Sylius.
• Track unusually low-value initial payments followed by large order fulfillment requests from the same customer or IP address.

How to Mitigate CVE-2026-100872

Immediate Actions Required

• Upgrade Sylius to version 2.1.16 or 2.2.9 or later as the primary remediation.
• Audit all orders completed since the vulnerable version was deployed and reconcile against gateway settlement records.
• Hold fulfillment on any orders flagged by reconciliation until amounts are verified.
• Rotate any API keys or webhook secrets if tampering activity is suspected.

Patch Information

Sylius released fixed versions 2.1.16 and 2.2.9 containing commit 9e9aeaa, which introduces the ClaimedByGatewayCheckerTrait and integrates it into OrderPaymentProcessor. See the GitHub Security Advisory GHSA-vv4h-q2x8-74g4, the Sylius Pull Request #19216, and the Sylius v2.2.9 Release for full technical context.

Workarounds

• If immediate upgrade is not possible, implement a custom event listener on cart modification events that rejects changes when any associated payment is in a captured or authorized state.
• Disable cart modification once a payment request has been dispatched to the gateway by overriding the storefront checkout controller.
• Enforce out-of-band reconciliation between gateway settlement totals and Sylius order totals before any fulfillment action is executed.

# Upgrade Sylius via Composer to the patched release
composer require sylius/sylius:^2.2.9
# or for the 2.1.x branch
composer require sylius/sylius:^2.1.16

# Clear cache after upgrade
php bin/console cache:clear --env=prod