CVE-2026-115937

Name of the Vulnerable Software and Affected Versions Craft Commerce (affected versions not specified)

Description The Mollie webhook endpoint allows an unauthenticated attacker to mark an unpaid order as paid in full. This occurs because the endpoint accepts two independent, attacker-controlled parameters without verifying their association: commerceTransactionHash, which selects the Craft Commerce transaction to be completed, and id, which selects the Mollie payment used to query the status. An attacker possessing any paid Mollie payment ID from the merchant account can pair it with any transaction hash. Consequently, the system queries Mollie, confirms a paid status, and marks the target transaction as successful for its full amount, regardless of the actual payment value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.