CVE-2026-108724: Sylius Auth Bypass Vulnerability

CVE-2026-108724 Overview

CVE-2026-108724 is an authorization bypass vulnerability [CWE-639] in the Sylius e-commerce platform through version 2.3.0. The flaw exists in the Shop API product review endpoint, where the AcceptedExtension Doctrine query filter is not applied to the item operation. Unauthenticated attackers can issue GET /api/v2/shop/product-reviews/{id} requests and enumerate sequential identifiers to retrieve reviews that merchants have not yet moderated or have explicitly rejected. Exposed data includes review titles, star ratings, comments, timestamps, and author first names. The vulnerability undermines merchant content moderation and exposes customer-submitted content that store operators intentionally withheld from public display.

Critical Impact
Unauthenticated attackers can bypass merchant review moderation and read unmoderated or rejected product reviews, including author first names, through sequential ID enumeration.

Affected Products

Sylius e-commerce platform versions through 2.3.0
Sylius ApiBundle Shop API (/api/v2/shop/product-reviews/{id} endpoint)
Deployments using the default AcceptedExtension query extension configuration

Discovery Timeline

2026-10-11 - CVE-2026-108724 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108724

Vulnerability Analysis

Sylius uses API Platform with Doctrine ORM query extensions to filter result sets based on business rules. The AcceptedExtension class in src/Sylius/Bundle/ApiBundle/Doctrine/ORM/QueryExtension/Shop/ProductReview/AcceptedExtension.php enforces that only reviews with an accepted status are returned to shop API consumers. The extension is registered in services/extensions.php but is only wired to the collection operation. The item operation GET /api/v2/shop/product-reviews/{id} executes without the filter. Any client supplying a numeric identifier retrieves the underlying review entity regardless of moderation state. Because review identifiers are sequential integers, an attacker can script enumeration across the full identifier space to harvest rejected and pending content.

Root Cause

The root cause is an incomplete application of an authorization filter across API Platform operations. The AcceptedExtension implements only the collection branch of the query extension interface and omits the item branch, so single-resource lookups bypass the moderation check entirely. This is a classic insecure direct object reference pattern tracked as [CWE-639] where access control relies on the client not knowing the identifier rather than on server-side enforcement.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network reachability to the Sylius shop API. An attacker iterates integer identifiers against the item endpoint and parses the JSON response. Each successful response returns the review title, rating, comment body, created and updated timestamps, and the author's first name. Rejected reviews that merchants removed for policy reasons remain retrievable, as do drafts awaiting moderation.

The vulnerability is described in detail in the HackMD Item Moderation Bypass Analysis and the VulnCheck Advisory: Sylius Authorization Bypass. The vulnerable code paths are visible in the Sylius Product Review Extension Code and the Sylius Services Configuration File.

Detection Methods for CVE-2026-108724

Indicators of Compromise

Sequential or high-volume GET requests to /api/v2/shop/product-reviews/{id} from a single source IP or small set of IPs.
HTTP 200 responses from the product review item endpoint for identifiers that are not referenced by any public product page.
Unauthenticated API traffic retrieving review records whose status column in the database is new or rejected.

Detection Strategies

Deploy a web application firewall rule that rate-limits requests to /api/v2/shop/product-reviews/{id} and flags enumeration patterns across incrementing identifiers.
Correlate API gateway logs with database state to identify responses that returned non-accepted reviews.
Audit access logs for unauthenticated clients that read a disproportionate number of distinct review IDs within a short window.

Monitoring Recommendations

Enable verbose logging on the Sylius ApiBundle and forward logs to a centralized analytics platform for anomaly review.
Track baseline request volume to shop review endpoints and alert on deviations exceeding normal shopper behavior.
Review Doctrine query logs for product review item lookups that bypass the accepted status predicate.

How to Mitigate CVE-2026-108724

Immediate Actions Required

Inventory all Sylius deployments and identify instances running version 2.3.0 or earlier.
Restrict public access to /api/v2/shop/product-reviews/{id} at the reverse proxy or API gateway until a patch is applied.
Review application logs for prior enumeration attempts and assess data exposure of rejected or pending reviews.

Patch Information

No fixed version is referenced in the published advisory at the time of writing. Monitor the Sylius GitHub Repository and the VulnCheck Advisory: Sylius Authorization Bypass for an official release. A proper fix requires registering the AcceptedExtension for the item operation so Doctrine applies the accepted-status predicate to single-resource lookups as well as collections.

Workarounds

Add a middleware or event subscriber that rejects item requests on /api/v2/shop/product-reviews/{id} when the loaded entity status is not accepted.
Replace numeric identifiers with unguessable UUIDs for product review resources to raise the cost of enumeration while a code fix is prepared.
Block the vulnerable item endpoint at the ingress layer if product review retrieval by ID is not required by the storefront.

bash

# Example nginx rule to block the vulnerable item endpoint
location ~ ^/api/v2/shop/product-reviews/[0-9]+$ {
    return 404;
}