PKSA-8ckb-ddkt-f3gz: Channel-based payment method restriction bypass on shop payment request API endpoint
Published Oct 22, 2026
·Updated
Channel-based payment method restriction bypass on shop payment request API endpoint
Affected Software
4 affected componentsFixes available
composer/sylius/sylius>=2.0.0, <2.1.0
composer/sylius/sylius>=2.1.0, <2.1.17
2.1.17
composer/sylius/sylius>=2.2.0, <2.2.12
2.2.12
composer/sylius/sylius>=2.3.0, <2.3.2
2.3.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.1.17 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.2.12 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Oct 22, 2026
Advisory Published
via Packagist·03:23 PM
Data Sourced
via Packagist·03:23 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which package is identified as affected?
The advisory identifies composer/sylius/sylius.
2
When was this issue published?
It was published on 2026-10-22.