PT-2026-24475 · Sylius · Sylius

Rokorolov · Published 2026-03-10 · Updated 2026-03-11 · CVE-2026-31821

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.0.16 Sylius versions prior to 2.1.12 Sylius versions prior to 2.2.3

Description The POST /api/v2/shop/orders/{tokenValue}/items endpoint in Sylius does not verify cart ownership. This allows an unauthenticated attacker to add items to other registered customers' carts if they know the tokenValue. An attacker obtaining a tokenValue can add arbitrary items to another customer’s cart. The endpoint returns the full cart representation in the response (HTTP 201).

Recommendations Update to Sylius version 2.0.16 or later. Update to Sylius version 2.1.12 or later. Update to Sylius version 2.2.3 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-31821

GHSA-WJMG-4CQ5-M8HG

Affected Products

Sylius

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31821.json · Exploit
• https://github.com/Sylius/Sylius/security/advisories/GHSA-wjmg-4cq5-m8hg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjmg-4cq5-m8hg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31821 · Security Note
• https://github.com/Sylius/Sylius · Note
• https://twitter.com/CVEnew/status/2031504081001255351 · Twitter Post