CVE-2026-108724
Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.
| CWE | CWE-639 |
| Vendor | sylius |
| Product | sylius |
| Published | Oct 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for sylius sylius
Be the first to know when new medium vulnerabilities affecting sylius sylius are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Sylius / Sylius
0 ≤ 2.3.0
References
hackmd.io: https://hackmd.io/@haind/sylius-shop-product-review-item-moderation-bypass github.com: https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Doctrine/ORM/QueryExtension/Shop/ProductReview/AcceptedExtension.php#L25-L59 github.com: https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Resources/config/services/extensions.php#L63-L67 github.com: https://github.com/Sylius/Sylius vulncheck.com: https://www.vulncheck.com/advisories/sylius-through-2.3.0-authorization-bypass-via-shop-api-product-review-endpoint
Credits
HaiND from the Post and Telecommunication Institute of Technology