CVE-2026-100871

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.12.25 Sylius versions prior to 1.13.17 Sylius versions prior to 1.14.20 Sylius versions prior to 2.1.16 Sylius versions prior to 2.2.9

Description JWT tokens issued by separate Admin and Shop API endpoints fail to include firewall identification. This allows an attacker to register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves as the administrator, resulting in full administrative access.

Recommendations Update to version 1.12.25 or later. Update to version 1.13.17 or later. Update to version 1.14.20 or later. Update to version 2.1.16 or later. Update to version 2.2.9 or later.