Junglewise Threat Intelligence

CVE-2026-68501: Sylius Mollie Plugin IDOR in order endpoints leads to PII leak

CVE-2026-68501 · Severity: medium · CVSS 6.5 · Published 2026-07-30

Executive brief

The Sylius Mollie Plugin, which integrates Mollie payments into the Sylius e-commerce platform, contains a security flaw in how it handles order information. An unauthorized person could guess order numbers to obtain secret access tokens, which then allow them to view customer names and email addresses. This could lead to the exposure of sensitive customer data and potentially damage a company's reputation.

Technical details

An Insecure Direct Object Reference (IDOR) exists in the `PageRedirectController::thankYouAction` and `QrCodeAction::fetchQrCodeFromOrder` endpoints of the Sylius Mollie Plugin. These endpoints look up orders using a sequential integer `orderId` without verifying ownership or session validity. An attacker can enumerate `orderId` values to obtain an order's `tokenValue` from the `Location` header of a 302 redirect. This token can then be used against the Sylius core `register-after-checkout` page to retrieve a pre-filled form containing the customer's first name, last name, and email address. The vulnerability is fixed in versions 2.2.8, 3.2.4, and 3.3.1.

Affected products

  • Sylius MolliePlugin < 2.2.8, >= 3.0.0, < 3.2.4, >= 3.3.0, < 3.3.1

Timeline

  • 2026-07-07: disclosed
  • 2026-07-30: advisory: NVD publication date
  • 2026-07-31: patched

References

Related threats