{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Sylius: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/sylius--sylius/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/sylius--sylius/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-108724/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-108724/",
   "title": "CVE-2026-108724 disclosed",
   "content_text": "Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.",
   "date_published": "2026-10-11T12:19:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100872/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100872/",
   "title": "CVE-2026-100872 disclosed",
   "content_text": "Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.",
   "date_published": "2026-09-27T13:09:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100871/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100871/",
   "title": "CVE-2026-100871 disclosed",
   "content_text": "Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.",
   "date_published": "2026-09-27T13:09:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100870/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100870/",
   "title": "CVE-2026-100870 disclosed",
   "content_text": "Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts.",
   "date_published": "2026-09-27T13:09:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100869/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100869/",
   "title": "CVE-2026-100869 disclosed",
   "content_text": "Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.",
   "date_published": "2026-09-27T13:09:54Z"
  }
 ]
}