CVE-2026-126737: Composer/drupal/mollie vulnerability
This module enables you to accept online payments on your website using Mollie.
This module doesn't sufficiently validate an incoming webhook call, allowing payments to be applied incorrectly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/mollieto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Websites using the composer/drupal/mollie module and accepting Mollie payments are exposed because the affected webhook handling can apply payments incorrectly.
What does an attacker need to exploit it?
An attacker needs to send an incoming webhook call that is not sufficiently validated by the module. The available information does not specify any additional authentication, access, or configuration prerequisites.
How can I determine whether my site may be affected?
Check whether composer/drupal/mollie is installed and used to process Mollie payment webhooks. If it is, review the Drupal security advisory and OSV record referenced for remediation and affected-version details.