PKSA-qzkx-mfzr-b1gq: Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data
Published Oct 22, 2026
·Updated
Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data
Affected Software
4 affected componentsFixes available
composer/sylius/sylius>=2.0.0, <2.1.0
composer/sylius/sylius>=2.1.0, <2.1.17
2.1.17
composer/sylius/sylius>=2.2.0, <2.2.12
2.2.12
composer/sylius/sylius>=2.3.0, <2.3.2
2.3.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.1.17 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.2.12 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Oct 22, 2026
Advisory Published
via Packagist·03:23 PM
Data Sourced
via Packagist·03:23 PM
DescriptionSeverityAffected Software