CVE-2026-68501

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1

Description The software fails to perform ownership or session checks when looking up sequential orderId values. This allows the exposure of tokenValue values through the endpoints 'GET /{ locale}/thank-you' (PageRedirectController::thankYouAction) and 'GET /{ locale}/get-code' (QrCodeAction::fetchQrCodeFromOrder). These tokens can subsequently be used with the endpoint 'GET /{ locale}/register-after-checkout/{tokenValue}' to retrieve sensitive customer information, including first name, last name, and email.

Recommendations Update to version 2.2.8. Update to version 3.2.4. Update to version 3.3.1.