CVE-2026-119038

Name of the Vulnerable Software and Affected Versions Business::GoCardless versions prior to 1.01

Description This issue allows a remote attacker who obtains a customer's redirect flow ID to create payments or subscriptions against that customer's mandate. The confirm resource() function fails to verify the session token from the caller. Instead, it retrieves the redirect flow from the GoCardless API and completes it using the token from that response, causing the session check to always pass. In version 1.00, if a flow already has a mandate, it is returned as confirmed without being completed again, allowing the same ID to generate a new payment on every call.

Recommendations Update Business::GoCardless to version 1.01 or later.