Advisory · CVE-2026-100872
Sylius checkout let attackers inflate orders after paying
Sylius 2.x did not revalidate payment amounts during cart recalculation, so an attacker could pay a small amount, enlarge the order, and have it marked fully paid.
- Vendor
- Sylius
- Product
- Sylius
- Identifier / CWE
- CVE-2026-100872
CWE-345 - Action timing
- Immediate
Explain it like I’m five
Sylius checked the price on the cash register tape once, then let the shopper add more items to the bag without re-checking. The register still said paid in full, even though the payment only covered the original small bill.
- 01Small order started
The attacker begins checkout with a small order and initiates the gateway transaction.
- 02Gateway captures
The payment gateway captures only the original small amount.
- 03Cart enlarged
During cart recalculation, the attacker modifies the order totals, enlarging the order without new payment validation.
- 04Marked paid
Sylius marks the inflated order as fully paid, even though the gateway captured only the original amount.
What happened
Sylius versions before 2.1.16 and 2.2.9 failed to validate payment amounts during cart recalculation. An unauthenticated attacker could modify order totals after the gateway transaction was initiated: pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
The flaw is fixed in Sylius 2.1.16 and 2.2.9.
What to do
- Upgrade Sylius 2.x to 2.1.16, 2.2.9, or later.
- Reconcile orders against gateway settlement records; look for orders whose captured amount is lower than the final order total.
- Review checkout and cart-recalculation requests for total modifications after payment initiation.
- Hold or investigate suspicious orders before fulfillment and tighten order-total integrity checks at the gateway callback boundary.
Management note
This is direct revenue impact with a trivially repeatable technique, and it requires no account and no victim. The upgrade stops it, but the reconciliation is what finds orders that already slipped through, and finance should be in the loop on that review.