CVE-2026-68500

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68500
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68500.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68500
Aliases
Published
2026-07-30T20:15:11.785Z
Modified
2026-07-31T11:45:42.777286139Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Sylius Mollie Plugin: Payment status forgery via the payment webhook
Details

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68500.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/sylius/mollieplugin

Affected ranges

Type
GIT
Repo
https://github.com/sylius/mollieplugin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a
Introduced
f0c05b8aeec1f6f3a152e6251c04514036ff5a1c
Fixed
153c754486b1bc597b67a90ac07ef71cd7958267
Introduced
6a4f6d17dc89812e61ef66e4b4139ad734d7f913
Fixed
ab939bb0d29f4e3b8e9c30ccc50159568a4245aa
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.8"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.2.4"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.1"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68500.json"