CVE-2026-100869

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.1.16 Sylius versions prior to 2.2.9

Description Insufficient restriction of payment request actions in the Shop API endpoint allows customers to trigger refunds on completed orders. An attacker possessing order tokens can submit arbitrary payment actions, such as refunds, which are then executed by payment gateways. This results in financial loss as the system continues to maintain the order status as paid.

Recommendations Update to version 2.1.16 or later. Update to version 2.2.9 or later.