Medium
Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
Type: advisorySources: OSV
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-68501
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 04:17 UTC · Revision 1
Source evidence
Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
core-osv · Original sourcePublished 30 Jul 2026, 20:27 UTC
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
osv:CVE-2026-68501
Complete source record
{
"id": "4bcd8173129e274f9c4777fbc2d76afab3693414e90c9324d1913034f48fe32d",
"url": "https://osv.dev/vulnerability/CVE-2026-68501",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII",
"summary": "Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.",
"evidence": "osv:CVE-2026-68501",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-68501",
"aliases": [
"CVE-2026-68501",
"GHSA-x83g-979r-f5fh"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sylius/mollieplugin",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a"
},
{
"introduced": "f0c05b8aeec1f6f3a152e6251c04514036ff5a1c"
},
{
"fixed": "153c754486b1bc597b67a90ac07ef71cd7958267"
},
{
"introduced": "6a4f6d17dc89812e61ef66e4b4139ad734d7f913"
},
{
"fixed": "ab939bb0d29f4e3b8e9c30ccc50159568a4245aa"
},
{
"fixed": "01316b3ad3cf82e3c5ad160115d0a2cf89174e49"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.2.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "01316b3ad3cf82e3c5ad160115d0a2cf89174e49"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "153c754486b1bc597b67a90ac07ef71cd7958267"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.2.8"
},
{
"range": [
{
"fixed": "153c754486b1bc597b67a90ac07ef71cd7958267"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.2.4"
},
{
"range": [
{
"fixed": "ab939bb0d29f4e3b8e9c30ccc50159568a4245aa"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.3.1"
}
]
}
}
],
"versions": [
"v3.2.3",
"v2.2.7",
"v3.3.0",
"v3.2.2",
"v3.2.1",
"v2.2.6",
"v2.2.5",
"v2.2.4",
"v2.2.3",
"v3.2.0",
"v2.2.2",
"v2.2.1",
"v3.1.1",
"v3.1.0",
"v3.0.0",
"v2.2.0",
"v2.1.0",
"v2.0.1",
"v2.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68501.json"
}
}
],
"modified": "2026-10-28T02:30:42.454156523Z",
"provider": "osv",
"references": [
"https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8",
"https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4",
"https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68501.json",
"https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh",
"https://nvd.nist.gov/vuln/detail/CVE-2026-68501",
"https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49",
"https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267",
"https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a",
"https://github.com/Sylius/MolliePlugin/pull/351",
"https://github.com/Sylius/MolliePlugin/pull/352",
"https://github.com/Sylius/MolliePlugin/pull/354"
],
"provider_metadata": {
"cwe_ids": [
"CWE-639"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68501.json"
}
},
"related_cves": [
{
"value": "CVE-2026-68501",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 510198,
"published_at": "2026-07-30T20:27:34.465+00:00"
}