CVE-2026-31820: Sylius Information Disclosure Vulnerability

CVE-2026-31820 Overview

CVE-2026-31820 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Sylius Open Source eCommerce Framework built on Symfony. The vulnerability exists in multiple shop LiveComponents that accept unvalidated resource IDs via #[LiveArg] parameters. Unlike props protected by LiveComponent's @checksum, args are fully user-controlled, allowing authenticated attackers to access sensitive data belonging to other users.

The vulnerability affects three critical components: the Checkout address FormComponent, Cart WidgetComponent, and Cart SummaryComponent. Each component accepts resource identifiers without proper ownership validation, enabling unauthorized access to customer personal information and order details.

Critical Impact

Authenticated attackers can access sensitive customer data including personal information (names, addresses, phone numbers), order totals, item counts, subtotals, discounts, shipping costs, and tax information from both active carts and completed orders.

Affected Products

• Sylius versions prior to 2.0.16
• Sylius versions prior to 2.1.12
• Sylius versions prior to 2.2.3

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-31820 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-31820

Vulnerability Analysis

This IDOR vulnerability stems from improper authorization controls in Sylius's LiveComponent implementations. The affected components accept resource identifiers through #[LiveArg] parameters and subsequently load resources using repository ->find() methods without validating that the requesting user has ownership rights to the requested resource.

The Checkout address FormComponent's addressFieldUpdated action accepts an addressId via #[LiveArg] and loads address records without verifying ownership. This exposes another user's first name, last name, company, phone number, street, city, postcode, and country information.

Both the Cart WidgetComponent and Cart SummaryComponent's refreshCart actions accept a cartId via #[LiveArg] and load order records directly from the repository. The WidgetComponent exposes order totals and item counts, while the SummaryComponent exposes subtotal, discount, shipping cost, taxes (both excluded and included), and order total.

A critical factor amplifying this vulnerability is that the sylius_order table contains both active carts (state=cart) and completed orders (state=new/fulfilled) in the same ID space. This means the cart IDOR exposes data from all orders, not just active shopping carts.

Root Cause

The root cause is classified as CWE-639: Authorization Bypass Through User-Controlled Key. The vulnerability arises from a fundamental misunderstanding of the security model for LiveComponent parameters. While props are protected by LiveComponent's @checksum mechanism, args are entirely user-controlled and require explicit authorization checks that were not implemented in the affected components.

Attack Vector

The attack requires network access and low-privilege authentication. An attacker with a valid user account can manipulate the #[LiveArg] parameters sent to the vulnerable LiveComponents, substituting their own resource IDs with those belonging to other users. Since the application fails to validate resource ownership before returning data, the attacker receives sensitive information belonging to the target user.

The attack can be executed by intercepting and modifying LiveComponent requests, incrementing or enumerating resource IDs to discover and access other users' addresses, carts, and completed orders. The network-based attack vector combined with low complexity makes this vulnerability particularly accessible to malicious actors.

Detection Methods for CVE-2026-31820

Indicators of Compromise

• Unusual patterns of requests to LiveComponent endpoints with sequential or enumerated resource IDs
• Single user accounts accessing multiple distinct address IDs or cart IDs in rapid succession
• HTTP requests to addressFieldUpdated or refreshCart actions containing resource IDs not associated with the authenticated user
• Anomalous spikes in LiveComponent request volumes from individual user sessions

Detection Strategies

• Implement logging for all LiveComponent actions that accept resource IDs via #[LiveArg] parameters
• Deploy application-layer monitoring to correlate requested resource IDs with authenticated user ownership records
• Configure web application firewalls to detect enumeration patterns in request parameters
• Enable audit trails for sensitive data access in checkout and cart components

Monitoring Recommendations

• Review access logs for LiveComponent endpoints, particularly addressFieldUpdated and refreshCart actions
• Monitor for authentication sessions that access resources belonging to multiple user accounts
• Establish baseline metrics for normal LiveComponent usage patterns to identify anomalous behavior
• Implement real-time alerting for suspected IDOR exploitation attempts

How to Mitigate CVE-2026-31820

Immediate Actions Required

• Upgrade Sylius immediately to version 2.0.16, 2.1.12, or 2.2.3 or later
• Audit application logs for evidence of prior exploitation
• Review any custom LiveComponents in your implementation for similar IDOR vulnerabilities
• Implement ownership validation for any custom code accepting user-controlled resource identifiers

Patch Information

Sylius has released patched versions that address this vulnerability. Organizations should upgrade to one of the following fixed versions based on their current branch:

• Version 2.0.16 for the 2.0.x branch
• Version 2.1.12 for the 2.1.x branch
• Version 2.2.3 for the 2.2.x branch

For detailed patch information and upgrade instructions, refer to the Sylius Security Advisory on GitHub.

Workarounds

• Implement custom middleware or event listeners to validate resource ownership before processing LiveComponent actions
• Add authorization checks in affected components to verify the authenticated user owns the requested resource before loading
• Consider temporarily disabling the affected LiveComponents if immediate patching is not feasible
• Deploy web application firewall rules to restrict access to vulnerable endpoints while preparing for upgrade

# Upgrade Sylius to patched version using Composer
composer require sylius/sylius:^2.2.3 --update-with-dependencies
php bin/console cache:clear
php bin/console doctrine:migrations:migrate