https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:37:37 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-68501 <p>Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin&#39;s GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.</p> <p>Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin&#39;s GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-68501 https://vulnerability.circl.lu/vuln/ghsa-x83g-979r-f5fh <p><strong>Affected:</strong> Packagist: sylius/mollie-plugin</p> <p>### Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer `orderId` with no ownership or session check. Chained, they expose customer PII.</p> <p>`GET /{_locale}/thank-you` (`PageRedirectController::thankYouAction`, route `sylius_mollie_shop_thank_you_page_redirect`) loads the order with `findOneBy([&#39;id&#39; =&gt; $orderId])` and returns a `302` whose `Location` header carries that order&#39;s `tokenValue`. Any `orderId` thus yields that order&#39;s token. A non-existent id dereferences null and returns a `500`. The handler also writes the raw `orderId` into the session.</p> <p>`GET /{_locale}/get-code` (`QrCodeAction::fetchQrCodeFromOrder`, route `sylius_mollie_shop_get_qr_code`) runs the same lookup and returns the order&#39;s QR code and id as JSON, ignoring the session cart; this is where the front-end got the integer id. A bad id `500`s here too.</p> <p>That `tokenValue` is the order&#39;s only access control. Passed to the Sylius core page `GET /{_locale}/register-after-checkout/{tokenValue}` it returns a form pre-filled with the customer&#39;s first name, last name and email. The full attack: enumerate `orderId`, read the token from the redirect, read the PII, at roughly a 1-in-71 hit rate for guest orders. `register-after-checkout` is Sylius core, not the plugin, and trusts the token by design, so the leak is what must be fixed.</p> <p>None of the plugin endpoints require a login, session or CSRF token.</p> <p>### Patches Fixed in **2.2.8**, **3.2.4** and **3.3.1**.</p> <p>### Workarounds If yo…</p> <p><strong>Affected:</strong> Packagist: sylius/mollie-plugin</p> <p>### Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer `orderId` with no ownership or session check. Chained, they expose customer PII.</p> <p>`GET /{_locale}/thank-you` (`PageRedirectController::thankYouAction`, route `sylius_mollie_shop_thank_you_page_redirect`) loads the order with `findOneBy([&#39;id&#39; =&gt; $orderId])` and returns a `302` whose `Location` header carries that order&#39;s `tokenValue`. Any `orderId` thus yields that order&#39;s token. A non-existent id dereferences null and returns a `500`. The handler also writes the raw `orderId` into the session.</p> <p>`GET /{_locale}/get-code` (`QrCodeAction::fetchQrCodeFromOrder`, route `sylius_mollie_shop_get_qr_code`) runs the same lookup and returns the order&#39;s QR code and id as JSON, ignoring the session cart; this is where the front-end got the integer id. A bad id `500`s here too.</p> <p>That `tokenValue` is the order&#39;s only access control. Passed to the Sylius core page `GET /{_locale}/register-after-checkout/{tokenValue}` it returns a form pre-filled with the customer&#39;s first name, last name and email. The full attack: enumerate `orderId`, read the token from the redirect, read the PII, at roughly a 1-in-71 hit rate for guest orders. `register-after-checkout` is Sylius core, not the plugin, and trusts the token by design, so the leak is what must be fixed.</p> <p>None of the plugin endpoints require a login, session or CSRF token.</p> <p>### Patches Fixed in **2.2.8**, **3.2.4** and **3.3.1**.</p> <p>### Workarounds If yo…</p> https://vulnerability.circl.lu/vuln/ghsa-x83g-979r-f5fh