{"id":"CVE-2026-100869","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-100869","generatedAt":"2026-10-28T04:35:38.803Z","title":"Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders.","description":"Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.","published":"2026-09-27T13:16:38.000Z","lastModified":"2026-09-28T20:57:50.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.2,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-863"],"affected":[],"epss":{"score":0.00263,"percentile":0.18004,"date":"2026-10-27","history":[{"date":"2026-09-28","score":0.00263,"percentile":0.16257}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-27T13:16:38.000Z","detail":{"score":"8.2","severity":"HIGH","publishedAt":"2026-09-27T13:16:38.100Z"},"summary":"New CVE, high severity (CVSS 8.2)."}],"references":[{"url":"https://github.com/Sylius/Sylius","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75d","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Sylius/Sylius/pull/19214","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Sylius/Sylius/releases/tag/v2.2.9","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Sylius/Sylius/security/advisories/GHSA-2rv4-pjmm-7fxf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-arbitrary-payment-action-via-shop-api","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100869","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}