CVE-2026-100869: Sylius

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.

Affected products

• Sylius Sylius: from 2.0.0, before 2.1.16 (fixed in 2.1.16); from 2.2.0, before 2.2.9 (fixed in 2.2.9)

Published 2026-09-27. Last modified 2026-09-28.