Listen to this Post
Intro
CVE-2026-68500 is an authorization bypass vulnerability in the Sylius Mollie Plugin that allows an unauthenticated attacker to forge payment statuses for arbitrary orders.
The root cause lies in the plugin’s payment webhook endpoint, `POST /{_locale}/update-payment` (route sylius_mollie_shop_payment_webhook). This endpoint accepts two independent, attacker-controlled parameters: `id` (the Mollie payment ID) and `orderId` (the Sylius order ID). While the `id` parameter is verified against Mollie’s API to ensure it’s a valid payment, the handler never verifies that this Mollie payment actually belongs to the referenced Sylius order.
An attacker who possesses any valid, paid Mollie payment ID—for instance, from a €1 order they placed themselves—can submit this ID together with any victim’s orderId. The victim’s order payment is then transitioned to a “completed” state (or any other Mollie-derived state) without any actual funds being transferred for that order.
Sylius order IDs are sequential integers, and the endpoint requires no authentication, CSRF token, or rate limiting. This makes the attack trivially scalable across all pending orders. The vulnerability affects all versions prior to 2.2.8, 3.2.4, and 3.3.1.
The fix, implemented in patched versions, binds the payment to the order by reading the server-side stored Mollie payment ID for that order and comparing it to the incoming ID. On mismatch, the request is acknowledged with HTTP 200 and no state change is applied—HTTP 200 is intentional because Mollie retries the webhook on any non-2xx response. The fix reads the stored ID from two possible sources: `payment.getDetails()[‘payment_mollie_id’]` for standard flows and `order.getMolliePaymentId()` for the QR-code flow.
DailyCVE Form:
Platform: Sylius Mollie Plugin
Version: <2.2.8, 3.0.0-3.2.3, 3.3.0
Vulnerability: Payment Status Forgery
Severity: High (CVSS 7.5)
date: 2026-07-30
Prediction: 2026-07-07 (Released)
What Undercode Say:
Analytics of the vulnerability shows the attack requires no privileges and can be executed remotely with low complexity.
Identify affected version composer show sylius/mollie-plugin Check if endpoint is exposed curl -X POST https://example.com/en_US/update-payment?id=valid_mollie_id&orderId=123
The webhook controller fails to validate ownership, creating a classic Insecure Direct Object Reference (IDOR) flaw.
Exploit:
An attacker can exploit this by:
- Obtaining any valid, paid Mollie payment ID (e.g., from their own €1 order).
- Enumerating or guessing a victim’s `orderId` (sequential integers).
3. Sending a POST request to `/en_US/update-payment?id=attacker_payment_id&orderId=victim_order_id`.
Example exploit request curl -X POST https://target-shop.com/en_US/update-payment \ -d "id=tr_12345abcde" \ -d "orderId=456"
The victim’s order is marked as paid without any funds being transferred.
Protection:
Immediate: Upgrade to patched versions 2.2.8, 3.2.4, or 3.3.1.
Workaround: If unable to upgrade immediately, implement a decorator controller that validates incoming Mollie payment IDs against server-stored values before processing the webhook.
// src/Controller/Mollie/SecurePaymentWebhookController.php
final class SecurePaymentWebhookController
{
// ... [Full decorator code as provided in the ] ...
}
Register the decorator in `config/services.yaml`:
services: App\Controller\Mollie\SecurePaymentWebhookController: decorates: sylius_mollie.controller.shop.payment_webhook public: true arguments: $inner: '@.inner' $orderRepository: '@sylius.repository.order'
Clear the cache afterwards.
Impact:
Successful exploitation allows an unauthenticated attacker to mark any order as paid without transferring funds. This leads to significant financial risk for the merchant, including revenue loss, inventory discrepancies, and potential for fraudulent claims. The vulnerability has a high integrity impact, as it allows unauthorized modification of payment states.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
