CVE-2026-53639 Overview
CVE-2026-53639 is an Insecure Direct Object Reference (IDOR) vulnerability in Sylius, an open source eCommerce framework built on Symfony. The flaw affects the shop payment request API endpoints, which resolve resources solely by URL parameters without verifying ownership. An attacker who obtains a payment request hash or order tokenValue can read payment data, recover order details including customer email and addresses, or manipulate redirect targets to intercept buyers after payment. The vulnerability is classified under [CWE-639: Authorization Bypass Through User-Controlled Key].
Critical Impact
Attackers with knowledge of a payment request hash can exfiltrate order data and hijack post-payment redirects to attacker-controlled URLs without any authentication.
Affected Products
- Sylius 2.0.0 through 2.0.17
- Sylius 2.1.0 through 2.1.14
- Sylius 2.2.0 through 2.2.5
Discovery Timeline
- 2026-09-08 - CVE-2026-53639 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-53639
Vulnerability Analysis
The vulnerability affects three shop API endpoints in Sylius. The GET /api/v2/shop/payment-requests/{hash} and PUT /api/v2/shop/payment-requests/{hash} endpoints look up the payment request using only the hash from the URL. The POST /api/v2/shop/orders/{tokenValue}/payment-requests endpoint resolves the target order using only the tokenValue from the URL. None of these endpoints validates that the authenticated customer owns the referenced resource.
On the GET endpoint, an attacker can read the payment request response, which includes a payment IRI. That IRI exposes the underlying order's tokenValue, granting access to order line items, shipping and billing addresses, the customer email, and totals. On the PUT endpoint, an attacker can modify fields such as target_path and after_path, which the front-end controller uses to redirect the buyer after payment completion.
Root Cause
The root cause is a missing authorization check in the API resource providers. The framework's state provider layer treats possession of the resource identifier as sufficient proof of access. No query extension enforces a filter on the authenticated customer, and no state provider decorator verifies ownership before returning or mutating the payment request.
Attack Vector
Exploitation requires the attacker to obtain a payment request hash out-of-band. Sources include server logs, HTTP referrer headers leaked to third-party sites, shared payment links, browser history on shared devices, or a co-located client on the same network. Once the UUID hash is known, no authentication token or order token is required. The attacker sends a direct HTTP request to the vulnerable endpoint and receives the payment data, or issues a PUT request that alters target_path to redirect the victim to a phishing page after checkout.
Refer to the Sylius GitHub Security Advisory for full technical details.
Detection Methods for CVE-2026-53639
Indicators of Compromise
- Unauthenticated or cross-account HTTP requests to /api/v2/shop/payment-requests/{hash} endpoints in web server logs.
- PUT requests to payment request endpoints that modify target_path or after_path to external domains.
- POST requests to /api/v2/shop/orders/{tokenValue}/payment-requests originating from IPs unrelated to the order's customer session.
- Post-checkout redirects to unexpected external hostnames reported by customers.
Detection Strategies
- Enable verbose access logging on the Symfony API firewall and audit responses returning HTTP 200 for payment request lookups with mismatched customer sessions.
- Correlate payment-requests API activity with authenticated user IDs and flag any request where the resource owner differs from the caller.
- Implement application-layer alerts for changes to target_path and after_path values that point outside the merchant's approved domain list.
Monitoring Recommendations
- Ingest Sylius API logs into a centralized analytics platform and baseline expected request patterns per customer account.
- Monitor for enumeration behavior against UUID-based endpoints, including high request rates and elevated 404 or 403 response counts.
- Track egress redirect destinations from the payment completion controller and alert on any redirect to a domain not on an allowlist.
How to Mitigate CVE-2026-53639
Immediate Actions Required
- Upgrade Sylius to version 2.0.18, 2.1.15, or 2.2.6 depending on the deployed branch.
- Rotate any payment request hashes that may have been exposed through logs, referrer headers, or shared links.
- Review web server and reverse proxy logs for prior unauthorized access to the affected endpoints.
- Restrict outbound redirect targets from the payment completion controller to an explicit allowlist of merchant-controlled domains.
Patch Information
The Sylius maintainers fixed the flaw in versions 2.0.18, 2.1.15, and 2.2.6. The patches introduce ownership checks across the affected API operations. Details are published in the Sylius GitHub Security Advisory GHSA-mr9r-h354-966r.
Workarounds
- Add an API Platform query extension that filters the GET payment request operation by the authenticated customer.
- Decorate the PUT state provider to enforce the same ownership check before allowing updates.
- Guard the POST /api/v2/shop/orders/{tokenValue}/payment-requests creation endpoint with a command-bus middleware that verifies the caller owns the target order.
- Wire the custom services in the Symfony service container so they replace the vulnerable defaults.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
