« Volver al listado

CVE-2026-68500

Estado: AplazadaAlta (7.5)—

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto sin autenticación ni interacción (AV:N/PR:N/UI:N) a endpoint de webhook; impacto de modificación de datos de pedidos (I:H) y suplantación de integridad de transacciones.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationVulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementPassword PoliciesMulti-factor Authentication

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sylius — Mollie PluginAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68500",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-68500",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-31T14:36:41.859832Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Sylius",
          "product": "MolliePlugin",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.2.8"
            },
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.2.4"
            },
            {
              "status": "affected",
              "version": ">= 3.3.0, < 3.3.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-30T21:18:13.007",
  "references": [
    {
      "url": "https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/pull/351",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/pull/352",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/pull/354",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-rc52-c4hv-w89p",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1."
    }
  ],
  "lastModified": "2026-09-10T20:12:43.783",
  "sourceIdentifier": "security-advisories@github.com"
}