Medium

List of order ids, number, items total and token value exposed for unauthorized uses via new API

Disclosed: 29.06.2021
Updated: 11.10.2026 10:22

Impact

Part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time.

Patches

The problem has been patched at Sylius 1.9.5 and 1.10.0

Workarounds

There are a few ways to fix this without updating the code.

The first possible solution is to hide the problematic endpoints behind the firewall from not logged in users. In order to achieve it one has to add the configuration in config/packages/security.yaml:

yaml

    access_control:
        # ... 
        - { path: "%sylius.security.new_api_shop_regex%/orders", role: IS_AUTHENTICATED_ANONYMOUSLY, methods: [POST] }
        - { path: "%sylius.security.new_api_shop_regex%/orders", role: ROLE_USER, methods: [GET] }

This would put only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it will have access to theirs orders only.

The second possible solution is to decorate the \Sylius\Bundle\ApiBundle\Doctrine\QueryCollectionExtension\OrdersByLoggedInUserExtension and throw Symfony\Component\Security\Core\Exception\AccessDeniedException if the class is executed for unauthorized user.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	sylius/sylius	>= 1.9.0, < 1.9.5	1.9.5

References

CVSS score 5.3/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-200
Platform: Composer
Package: sylius/sylius
Disclosed: 29.06.2021
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-rpxh-vg2x-526v - CC BY 4.0

Vulnerability history: sylius/sylius

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive

Total entries: 23
First → latest: 12.2019 07.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 4
Medium 17
Low 2

Disclosures per year

2019: 1
2020: 3
2021: 1
2022: 4
2023: 0
2024: 4
2025: 0
2026: 10

11.03.2026

Sylius has a Promotion Usage Limit Bypass via Race Condition

High · 8.2 CVE-2026-31824 < 1.9.12, >= 1.10.0, < 1.10.16, >= 1.11.0, < 1.11.17, >= 1.12.0, < 1.12.23, >= 1.13.0, < 1.13.15, >= 1.14.0, < 1.14.18, >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3
11.03.2026

Sylius affected by IDOR in Cart and Checkout LiveComponents

High CVE-2026-31820 >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 2.0.16, 2.1.12, 2.2.3
17.07.2024

Sylius has a security vulnerability via adjustments API endpoint

High · 7.5 CVE-2024-40633 >= 1.12.0-alpha.1, < 1.12.19, >= 1.13.0-alpha.1, < 1.13.4, < 1.9.12, >= 1.10.0-alpha.1, < 1.10.16, >= 1.11.0-alpha.1, < 1.11.17 1.12.19, 1.13.4, 1.9.12, 1.10.16, 1.11.17
14.03.2022

Insufficient Session Expiration in Sylius

High · 7.1 CVE-2022-24743 >= 1.10.0, < 1.10.11, >= 1.11.0, < 1.11.2 1.10.11, 1.11.2
29.06.2021

List of order ids, number, items total and token value exposed for unauthorized uses via new API this entry

Medium · 5.3 CVE-2021-32720 >= 1.9.0, < 1.9.5 1.9.5

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application