# CVE-2026-100872: Sylius payment amount validation bypass in cart recalculation

Source: https://junglewise.ai/threats/cve-2026-100872-sylius-versions-before-2-1-16-and-2-2-9-fail-to-validate-payment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100872 · Severity: high · CVSS 7.5 · Published 2026-09-27

Sylius is an open-source e-commerce platform used to power online stores and sales operations. The platform fails to properly validate order totals after a customer initiates a payment with a payment gateway, allowing an attacker to increase the order amount after the gateway has already captured payment for the original smaller amount. An attacker could exploit this to receive goods or services while paying significantly less, resulting in direct financial loss to the merchant.

Technologies: [Sylius](https://junglewise.ai/threats/technologies/sylius). Vendors: [Sylius](https://junglewise.ai/threats/vendors/sylius).

## Quick answers

**Is CVE-2026-100872 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100872 being exploited in the wild.

**How severe is CVE-2026-100872?** High severity, with a CVSS score of 7.5, published 27 September 2026.

**Which products and versions are affected?** Sylius before 2.1.16 and before 2.2.9.

**Is there a fix for CVE-2026-100872?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100872 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100872?** Check whether you run Sylius at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Sylius's cart recalculation logic, which does not re-validate payment amounts during the post-gateway-capture phase. An unauthenticated attacker can modify an order total after initiating a transaction with the payment gateway, causing the system to mark an inflated order as fully paid even though the gateway only captured the original lower amount. This is a logic flaw in the payment reconciliation process with no authentication requirement.

## Affected products

- Sylius Sylius before 2.1.16 and before 2.2.9

## Timeline

- 2026-09-27: disclosed

## References

- [https://packagist.org/](https://packagist.org/)
- [https://github.com/Sylius/Sylius](https://github.com/Sylius/Sylius)

## Related threats

- [Sylius authorization bypass in product review API](https://junglewise.ai/threats/cve-2026-108724-sylius-through-2-3-0-contains-an-authorization-bypass)
- [Sylius JWT token firewall identification bypass](https://junglewise.ai/threats/cve-2026-100871-sylius-versions-before-1-12-25-1-13-17-1-14-20-2-1-16-and-2-2-9)
- [Sylius password-reset link Host header injection](https://junglewise.ai/threats/cve-2026-100870-sylius-versions-before-1-12-25-1-13-17-1-14-20-2-1-16-and-2-2-9)
- [Sylius Shop API payment refund authorization bypass](https://junglewise.ai/threats/cve-2026-100869-sylius-versions-before-2-1-16-and-2-2-9-fail-to-restrict-payment)
- [Sylius IDOR in Shop Payment Request API endpoints](https://junglewise.ai/threats/cve-2026-53639-sylius-idor-in-shop-payment-request-api-endpoints)