CVE-2026-31821: Sylius

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer's cart. The endpoint returns the full cart representation in the response (HTTP 201). The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

Affected products

• Sylius Sylius: from 2.0.0, before 2.0.16 (fixed in 2.0.16); from 2.1.0, before 2.1.12 (fixed in 2.1.12); from 2.2.0, before 2.2.3 (fixed in 2.2.3)

Published 2026-03-10. Last modified 2026-06-17.