CVE-2026-68501: Sylius Mollie Plugin IDOR in order endpoints leads to PII leak

CVE-2026-68501 · Severity: medium · CVSS 6.5 · Published 2026-07-30

The Sylius Mollie Plugin, which integrates Mollie payments into the Sylius e-commerce platform, contains a security flaw in how it handles order information. An unauthorized person could guess order numbers to obtain secret access tokens, which then allow them to view customer names and email addresses. This could lead to the exposure of sensitive customer data and potentially damage a company's reputation.

Vendors: Packagist, Sylius.

Quick answers

Is CVE-2026-68501 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68501 being exploited in the wild.
How severe is CVE-2026-68501?
Medium severity, with a CVSS score of 6.5, published 30 July 2026.
Which products and versions are affected?
sylius/mollie-plugin (Packagist) ECOSYSTEM:introduced=0,fixed=2.2.8; Sylius MolliePlugin < 2.2.8, >= 3.0.0 < 3.2.4, >= 3.3.0 < 3.3.1, < 2.2.8, >= 3.0.0, < 3.2.4, >= 3.3.0, < 3.3.1.
Is there a fix for CVE-2026-68501?
Yes. sylius/mollie-plugin (Packagist): upgrade to 2.2.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68501 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-68501?
Check whether you run sylius/mollie-plugin (Packagist) or Sylius MolliePlugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sylius/mollie-plugin (Packagist): upgrade to 2.2.8 or later
    composer require sylius/mollie-plugin:^2.2.8

Technical details

An Insecure Direct Object Reference (IDOR) exists in the `PageRedirectController::thankYouAction` and `QrCodeAction::fetchQrCodeFromOrder` endpoints of the Sylius Mollie Plugin. These endpoints look up orders using a sequential integer `orderId` without verifying ownership or session validity. An attacker can enumerate `orderId` values to obtain an order's `tokenValue` from the `Location` header of a 302 redirect. This token can then be used against the Sylius core `register-after-checkout` page to retrieve a pre-filled form containing the customer's first name, last name, and email address. The vulnerability is fixed in versions 2.2.8, 3.2.4, and 3.3.1.

Affected products

  • Sylius MolliePlugin < 2.2.8, >= 3.0.0, < 3.2.4, >= 3.3.0, < 3.3.1

Identifiers

  • CVE-2026-68501
  • GHSA-x83g-979r-f5fh

Timeline

  • 2026-07-07: disclosed
  • 2026-07-30: advisory: NVD publication date
  • 2026-07-31: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.