CVE-2026-68501
Impact
Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId
with no ownership or session check. Chained, they expose customer PII.
GET /{_locale}/thank-you (PageRedirectController::thankYouAction, route
sylius_mollie_shop_thank_you_page_redirect) loads the order with findOneBy(['id' => $orderId])
and returns a 302 whose Location header carries that order's tokenValue. Any orderId
thus yields that order's token. A non-existent id dereferences null and returns a 500. The
handler also writes the raw orderId into the session.
GET /{_locale}/get-code (QrCodeAction::fetchQrCodeFromOrder, route
sylius_mollie_shop_get_qr_code) runs the same lookup and returns the order's QR code and id
as JSON, ignoring the session cart; this is where the front-end got the integer id. A bad id
500s here too.
That tokenValue is the order's only access control. Passed to the Sylius core page
GET /{_locale}/register-after-checkout/{tokenValue} it returns a form pre-filled with the
customer's first name, last name and email. The full attack: enumerate orderId, read the
token from the redirect, read the PII, at roughly a 1-in-71 hit rate for guest orders.
register-after-checkout is Sylius core, not the plugin, and trusts the token by design, so
the leak is what must be fixed.
None of the plugin endpoints require a login, session or CSRF token.
Patches
Fixed in 2.2.8, 3.2.4 and 3.3.1.
Workarounds
If you cannot upgrade immediately, patch both endpoints at the project level by decorating
the plugin controllers. The decorators enforce ownership before delegating to the original
controller, so no plugin behaviour is lost. They keep the original orderId request contract,
so no front-end or asset changes are required. Works on both 2.2 and 3.x.
Step 1. Decorate the QR code controller
Create src/Controller/Mollie/SecureQrCodeAction.php in your Sylius project:
<?php
declare(strict_types=1);
namespace App\Controller\Mollie;
use Sylius\Component\Order\Context\
⚡ Watch CVE-2026-68501
Get an email if CVE-2026-68501 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-68501)