CVE-2026-31821

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31821
Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer's cart. The endpoint returns the full cart representation in the response (HTTP 201). The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Sylius/Sylius/security/advisories/GHSA-wjmg-4cq5-m8hg Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
History

11 Mar 2026, 19:33

Type Values Removed Values Added
References () https://github.com/Sylius/Sylius/security/advisories/GHSA-wjmg-4cq5-m8hg - () https://github.com/Sylius/Sylius/security/advisories/GHSA-wjmg-4cq5-m8hg - Mitigation, Vendor Advisory
CPE cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
First Time Sylius
Sylius sylius

11 Mar 2026, 13:52

Type Values Removed Values Added
Summary
  • (es) Sylius es un Framework de eCommerce de Código Abierto en Symfony. El endpoint POST /api/v2/shop/orders/{tokenValue}/items no verifica la propiedad del carrito. Un atacante no autenticado puede añadir artículos a los carritos de otros clientes registrados conociendo el tokenValue del carrito. Un atacante que obtiene un tokenValue de carrito puede añadir artículos arbitrarios al carrito de otro cliente. El endpoint devuelve la representación completa del carrito en la respuesta (HTTP 201). El problema está solucionado en las versiones: 2.0.16, 2.1.12, 2.2.3 y superiores.

10 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 22:16

Updated : 2026-03-11 19:33

NVD link : CVE-2026-31821

Mitre link : CVE-2026-31821

CVE.ORG link : CVE-2026-31821

JSON object : View

Products Affected

sylius

  • sylius
CWE
CWE-862

Missing Authorization