CVE-2026-100872 — Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway trans…
Published: 2026-09-27 · CVSS: 8.7 · CVSS 4.0
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7