CVE-2026-68500

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1

Description The payment webhook at the POST /{ locale}/update-payment endpoint accepts the id and orderId parameters without verifying if the Mollie payment is actually associated with the referenced Sylius order. This allows an unauthenticated attacker to use any valid paid Mollie payment ID to mark a target order as paid without completing the actual fund transfer for that specific order.

Recommendations Update to version 2.2.8. Update to version 3.2.4. Update to version 3.3.1.