Junglewise Threat Intelligence

CVE-2026-68500: Sylius Mollie Plugin authorization bypass in payment webhook

CVE-2026-68500 · Severity: high · CVSS 7.5 · Published 2026-07-30

Executive brief

A vulnerability in the Sylius Mollie payment plugin allows attackers to mark orders as paid without actually transferring funds. By exploiting a flaw in how the system processes payment notifications, an attacker can use a single small payment to validate any number of other pending orders. This could lead to significant financial loss as orders may be fulfilled and shipped despite no payment being received.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) / Authorization Bypass (CWE-639) in the `sylius_mollie_shop_payment_webhook` route. The webhook handler accepts an `id` (Mollie payment ID) and an `orderId` (Sylius order ID) but fails to verify that the payment ID actually corresponds to the specified order. An attacker can provide a valid payment ID from a successful low-value transaction and pair it with sequential victim `orderId` values. Because the endpoint lacks authentication, CSRF protection, or rate limiting, the attack can be automated to transition pending orders to a 'completed' state. The issue is fixed in versions 2.2.8, 3.2.4, and 3.3.1 by ensuring the incoming payment ID matches the ID stored server-side for that specific order.

Affected products

  • Sylius MolliePlugin < 2.2.8, >= 3.0.0, < 3.2.4, >= 3.3.0, < 3.3.1

Timeline

  • 2026-07-07: disclosed
  • 2026-07-30: advisory: NVD publication
  • 2026-07-31: patched

References

Related threats