Listen to this Post
How CVE-2026-68501 Works
This vulnerability resides in the Sylius Mollie Plugin, which integrates Mollie payment processing into Sylius e-commerce applications. Prior to patched versions (2.2.8, 3.2.4, and 3.3.1), two unauthenticated shop endpoints were susceptible to an Insecure Direct Object Reference (IDOR) attack.
The core issue is that these endpoints accept a sequential integer `orderId` as a user-controlled key and perform database lookups without verifying ownership or establishing a valid session. The first affected endpoint is GET /{_locale}/thank-you, handled by PageRedirectController::thankYouAction. This action loads an order using `findOneBy([‘id’ => $orderId])` and, upon finding it, returns a 302 redirect whose `Location` header contains that order’s tokenValue. This `tokenValue` is the primary, and often only, access control mechanism for the order. Crucially, this endpoint also writes the raw `orderId` into the user’s session.
The second vulnerable endpoint is GET /{_locale}/get-code, handled by QrCodeAction::fetchQrCodeFromOrder. It performs the identical unauthenticated lookup and returns the order’s ID and QR code as JSON.
An attacker can chain these vulnerabilities to access Personally Identifiable Information (PII). By enumerating sequential `orderId` values, an attacker can call the `/thank-you` endpoint to retrieve the `tokenValue` for any existing order. This token can then be passed to the legitimate Sylius core page, GET /{_locale}/register-after-checkout/{tokenValue}. Because the core Sylius system trusts this token by design, it will display a form pre-filled with the customer’s first name, last name, and email address. The attack is feasible, with an estimated success rate of roughly 1-in-71 for guest orders. None of the plugin endpoints require a login, session, or CSRF token, making this a severe information disclosure risk.
DailyCVE Form:
Platform: Sylius Mollie Plugin
Version: <2.2.8, >=3.0.0<3.2.4, >=3.3.0<3.3.1
Vulnerability: Unauthenticated IDOR
Severity: Medium (CVSS 6.5)
date: 2026-07-30
Prediction: 2026-08-15
Analytics under heading What Undercode Say:
Check installed version of sylius/mollie-plugin composer show sylius/mollie-plugin Audit for known vulnerabilities composer audit Identify endpoints accessible without authentication grep -r "sylius_mollie_shop_thank_you_page_redirect" . grep -r "sylius_mollie_shop_get_qr_code" . Check for vulnerable code pattern (findOneBy with user-controlled ID) grep -r "findOneBy" src/Controller/
How Exploit:
A remote, unauthenticated attacker can enumerate sequential order IDs to leak customer PII:
1. Enumerate `orderId` integers (e.g., 1001, 1002, …).
2. Send a GET request to `/{_locale}/thank-you?orderId={enumerated_id}`.
- Capture the `tokenValue` from the `Location` header of the 302 redirect.
4. Send a GET request to `/{_locale}/register-after-checkout/{tokenValue}`.
- View the pre-filled form containing the customer’s name and email.
Protection:
Immediate Upgrade: Update the `sylius/mollie-plugin` to version 2.2.8, 3.2.4, or `3.3.1` or higher.
Workaround (Decoration): If an immediate upgrade is not possible, implement controller decorators to enforce ownership checks:
1. Decorate `QrCodeAction` to verify the cart context.
2. Decorate `PageRedirectController` to check session-owned order IDs.
3. Register the decorators in `config/services.yaml`.
4. Clear the cache.
Impact:
Successful exploitation allows an unauthenticated attacker to access sensitive customer PII, including first name, last name, and email address. This information disclosure can lead to privacy violations, targeted phishing campaigns, and other social engineering attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
