CVE-2026-53637

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53637
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53637.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53637
Aliases
Published
2026-09-08T22:31:39Z
Modified
2026-09-10T03:30:33Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Sylius: Cart FormComponent allows modification or deletion of an already-completed order
Details

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched FormComponent into the application's src/ directory and override the sylius_shop.twig.component.cart.form service definition to use that class.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-672",
        "CWE-841"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53637.json"
}
References

Affected packages

Git / github.com/sylius/sylius

Affected ranges

Type
GIT
Repo
https://github.com/sylius/sylius
Events
Introduced
6dd3ca9895be7ab7e6cb71f37af2ef66af17cbe0
Fixed
45f70193ea0e83826ec72af4a92c806616539e71
Introduced
a5a816f9f1fcb5abd2d42b27801656aa2ae9bf0d
Fixed
894f29731765b1c1249ba73eb9df36c998f962ce
Introduced
7aa47be3a617f75337d73d245352ea700bc8a1ef
Fixed
a1a074a079bd023e211cbf226b2ca25f05e7bd0c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.18"
        },
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.1.15"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.1.1
v2.1.10
v2.1.11
v2.1.12
v2.1.13
v2.1.14
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53637.json"