CVE-2026-100872

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.1.16 Sylius versions prior to 2.2.9

Description An issue exists where payment amounts are not validated during cart recalculation. This allows unauthenticated attackers to modify order totals after a gateway transaction has been initiated. An attacker can pay a small amount, increase the order value after the gateway capture, and the system will mark the inflated order as fully paid despite the gateway only capturing the original smaller amount.

Recommendations Update to version 2.1.16 or later. Update to version 2.2.9 or later.