PT-2026-24475 · Sylius · Sylius

Rokorolov · Publicado 2026-03-10 · Atualizado 2026-03-11 · CVE-2026-31821

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.0.16 Sylius versions prior to 2.1.12 Sylius versions prior to 2.2.3

Description The POST /api/v2/shop/orders/{tokenValue}/items endpoint in Sylius does not verify cart ownership. This allows an unauthenticated attacker to add items to other registered customers' carts if they know the tokenValue. An attacker obtaining a tokenValue can add arbitrary items to another customer’s cart. The endpoint returns the full cart representation in the response (HTTP 201).

Recommendations Update to Sylius version 2.0.16 or later. Update to Sylius version 2.1.12 or later. Update to Sylius version 2.2.3 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-31821

GHSA-WJMG-4CQ5-M8HG

Produtos afetados

Sylius

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31821.json · Exploit
• https://github.com/Sylius/Sylius · Nota
• https://github.com/Sylius/Sylius/security/advisories/GHSA-wjmg-4cq5-m8hg · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wjmg-4cq5-m8hg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-31821 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031504081001255351 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31821 · Nota de Segurança