CVE-2026-68500: Sylius Mollie Plugin authorization bypass in payment webhook

CVE-2026-68500 · Severity: high · CVSS 7.5 · Published 2026-07-30

A vulnerability in the Sylius Mollie payment plugin allows attackers to mark orders as paid without actually transferring funds. By exploiting a flaw in how the system processes payment notifications, an attacker can use a single small payment to validate any number of other pending orders. This could lead to significant financial loss as orders may be fulfilled and shipped despite no payment being received.

Vendors: Packagist, Sylius.

Quick answers

Is CVE-2026-68500 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68500 being exploited in the wild.
How severe is CVE-2026-68500?
High severity, with a CVSS score of 7.5, published 30 July 2026.
Which products and versions are affected?
sylius/mollie-plugin (Packagist) ECOSYSTEM:introduced=0,fixed=2.2.8; Sylius MolliePlugin < 2.2.8, >= 3.0.0 < 3.2.4, >= 3.3.0 < 3.3.1, < 2.2.8, >= 3.0.0, < 3.2.4, >= 3.3.0, < 3.3.1.
Is there a fix for CVE-2026-68500?
Yes. sylius/mollie-plugin (Packagist): upgrade to 2.2.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68500 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-68500?
Check whether you run sylius/mollie-plugin (Packagist) or Sylius MolliePlugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sylius/mollie-plugin (Packagist): upgrade to 2.2.8 or later
    composer require sylius/mollie-plugin:^2.2.8

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) / Authorization Bypass (CWE-639) in the `sylius_mollie_shop_payment_webhook` route. The webhook handler accepts an `id` (Mollie payment ID) and an `orderId` (Sylius order ID) but fails to verify that the payment ID actually corresponds to the specified order. An attacker can provide a valid payment ID from a successful low-value transaction and pair it with sequential victim `orderId` values. Because the endpoint lacks authentication, CSRF protection, or rate limiting, the attack can be automated to transition pending orders to a 'completed' state. The issue is fixed in versions 2.2.8, 3.2.4, and 3.3.1 by ensuring the incoming payment ID matches the ID stored server-side for that specific order.

Affected products

  • Sylius MolliePlugin < 2.2.8, >= 3.0.0, < 3.2.4, >= 3.3.0, < 3.3.1

Identifiers

  • CVE-2026-68500
  • GHSA-rc52-c4hv-w89p

Timeline

  • 2026-07-07: disclosed
  • 2026-07-30: advisory: NVD publication
  • 2026-07-31: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.