CVE-2026-100872: Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Syliusto a version that resolves this vulnerability.Fixed in 2.1.16 - Upgrade
Upgrade
Syliusto a version that resolves this vulnerability.Fixed in 2.2.9
Event History
Frequently Asked Questions
Which deployments are affected?
Sylius 2.x deployments running versions earlier than 2.1.16 or 2.2.9 are affected. The issue involves payment handling during cart recalculation after a gateway transaction has been initiated.
Does exploitation require an account or user interaction?
No. The supplied vector indicates that exploitation is network-accessible, requires low attack complexity, and needs neither privileges nor user interaction.
What is the practical impact of a successful exploit?
An attacker can initiate payment for a small amount, increase the order total after gateway capture, and cause the application to treat the larger order as fully paid. The payment gateway captures only the original, smaller amount.
What versions should be used to remediate the issue?
Update to Sylius 2.1.16 or 2.2.9, depending on the supported release line in use. These are the versions identified as no longer affected.