Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

Affected: Packagist: sylius/mollie-plugin

### Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer `orderId` with no ownership or session check. Chained, they expose customer PII.

`GET /{_locale}/thank-you` (`PageRedirectController::thankYouAction`, route `sylius_mollie_shop_thank_you_page_redirect`) loads the order with `findOneBy(['id' => $orderId])` and returns a `302` whose `Location` header carries that order's `tokenValue`. Any `orderId` thus yields that order's token. A non-existent id dereferences null and returns a `500`. The handler also writes the raw `orderId` into the session.

`GET /{_locale}/get-code` (`QrCodeAction::fetchQrCodeFromOrder`, route `sylius_mollie_shop_get_qr_code`) runs the same lookup and returns the order's QR code and id as JSON, ignoring the session cart; this is where the front-end got the integer id. A bad id `500`s here too.

That `tokenValue` is the order's only access control. Passed to the Sylius core page `GET /{_locale}/register-after-checkout/{tokenValue}` it returns a form pre-filled with the customer's first name, last name and email. The full attack: enumerate `orderId`, read the token from the redirect, read the PII, at roughly a 1-in-71 hit rate for guest orders. `register-after-checkout` is Sylius core, not the plugin, and trusts the token by design, so the leak is what must be fixed.

None of the plugin endpoints require a login, session or CSRF token.

### Patches Fixed in **2.2.8**, **3.2.4** and **3.3.1**.

### Workarounds If yo…