CVE-2026-53637
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS probability
- 0.29%
- CWE
- CWE-672, CWE-841
- Published
- 2026-09-08
- Last modified
- 2026-09-09
Affected products
- Sylius Sylius
- Sylius Sylius
- Sylius Sylius
Weakness type
Related vulnerabilities
- CVE-2026-55250 — Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
- CVE-2026-61699 — nebula-mesh: Certificate revocation is never enforced at the mesh
- CVE-2026-85044 — Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a...
- CVE-2026-19538 — Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
- CVE-2026-79010 — Operation on a resource after expiration or release in Network in Google Chrome prior to...
- CVE-2026-44725 — EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
- CVE-2026-52733 — ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
- CVE-2026-50575 — BetterDesk has a replay behavior vulnerability when devices are deleted