CVE-2026-53638MEDIUM· 4.3GHSA대응게시일: 2026. 07. 09.수정일: 2026. 07. 09.

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

4.3medium

이론적 심각도 점수

EPSS

—

예측 데이터 없음

KEV

미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로

공격 벡터네트워크

공격 복잡도낮음

필요 권한낮음

사용자 상호작용불필요

범위불변

영향

기밀성 영향없음

무결성 영향낮음

가용성 영향없음

버전별 점수

CVSS 3.14.3MODERATE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

상세 설명

Impact

An authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state STATE_NEW), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}) correctly rejects out-of-channel payment methods with HTTP 422; the account endpoint silently accepts them and returns HTTP 200.

An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel.

Patches

The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above.

Workarounds

If users cannot bump Sylius right now, decorate the Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface service in their applications.

Step 1. Create the decorator

src/Decorator/ChannelCheckingPaymentMethodChanger.php:

bash

 1<?php
 2 
 3declare(strict_types=1);
 4 
 5namespace App\Decorator;
 6 
 7use ApiPlatform\Validator\Exception\ValidationException;
 8use Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface;
 9use Sylius\Component\Core\Model\OrderInterface;
10use Sylius\Component\Core\Model\PaymentMethodInterface;
11use Sylius\Component\Core\Repository\PaymentMethodRepositoryInterface;
12use Sylius\Component\Core\Repository\PaymentRepositoryInterface;
13use Sylius\Component\Payment\Resolver\PaymentMethodsResolverInterface;
14use Symfony\Component\Validator\ConstraintViolation;
15use Symfony\Component\Validator\ConstraintViolationList;
16use Symfony\Contracts\Translation\TranslatorInterface;
17 
18final readonly class ChannelCheckingPaymentMethodChanger implements PaymentMethodChangerInterface
19{
20    public function __construct(
21        private PaymentMethodChangerInterface $decorated,
22        private PaymentRepositoryInterface $paymentRepository,
23        private PaymentMethodRepositoryInterface $paymentMethodRepository,
24        private PaymentMethodsResolverInterface $paymentMethodsResolver,
25        private TranslatorInterface $translator,
26    ) {
27    }
28 
29    public function changePaymentMethod(string $paymentMethodCode, mixed $paymentId, OrderInterface $order): OrderInterface
30    {
31        /** @var PaymentMethodInterface|null $paymentMethod */
32        $paymentMethod = $this->paymentMethodRepository->findOneBy(['code' => $paymentMethodCode]);
33        $payment = $this->paymentRepository->findOneByOrderId($paymentId, $order->getId());
34 
35        if (
36            $paymentMethod !== null
37            && $payment !== null
38            && !in_array($paymentMethod, $this->paymentMethodsResolver->getSupportedMethods($payment), true)
39        ) {
40            $template = 'sylius.payment_method.not_available';
41            $parameters = ['%name%' => (string) $paymentMethod->getName()];
42 
43            throw new ValidationException(new ConstraintViolationList([
44                new ConstraintViolation(
45                    message: $this->translator->trans($template, $parameters, 'validators'),
46                    messageTemplate: $template,
47                    parameters: $parameters,
48                    root: $paymentMethodCode,
49                    propertyPath: '',
50                    invalidValue: $paymentMethodCode,
51                ),
52            ]));
53        }
54 
55        return $this->decorated->changePaymentMethod($paymentMethodCode, $paymentId, $order);
56    }
57}

Step 2. Register the decorator

config/services.yaml (append to the application's existing services: block):

text

 1services:
 2    App\Decorator\ChannelCheckingPaymentMethodChanger:
 3        decorates: sylius_api.changer.payment_method
 4        arguments:
 5            - '@.inner'
 6            - '@sylius.repository.payment'
 7            - '@sylius.repository.payment_method'
 8            - '@sylius.resolver.payment_methods'
 9            - '@translator'

@.inner references the original PaymentMethodChangerInterface implementation, so any future Sylius change to the changer keeps working through the decorator.

Step 3. Clear the cache

text

 1bin/console cache:clear

Reporters

We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:

Fredrik Dietrichson (@FredrikEV)

For more information

If there are any questions or comments about this advisory:

Open an issue in Sylius issues
Send an email to security@sylius.com

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 2

링크 내용 불러오는 중…