# CVE-2026-31820: Sylius affected by IDOR in Cart and Checkout LiveComponents

> Authenticated attackers can access other users' cart and order details by manipulating resource IDs in Sylius LiveComponents.

- **Severity:** High 7.1 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Mar 2026
- **Updated:** 11 Mar 2026
- **Also known as:** GHSA-2xc6-348p-c2x6

## What is CVE-2026-31820?

CVE-2026-31820 is a high-severity missing authorization vulnerability in Sylius, published on 10 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled - any action that accepts a resource ID via #[LiveArg] and loads it with ->find() without ownership validation is vulnerable. Checkout address FormComponent (addressFieldUpdated action): Accepts an addressId via #[LiveArg] and loads it without verifying ownership, exposing another user's first name, last name, company, phone number, street, city, postcode, and country. Cart WidgetComponent (refreshCart action): Accepts a cartId via #[LiveArg] and loads any order directly from the repository, exposing order total and item count. Cart SummaryComponent (refreshCart action): Accepts a cartId via #[LiveArg] and loads any order directly from the repository, exposing subtotal, discount, shipping cost, taxes (excluded and included), and order total. Since sylius_order contains both active carts (state=cart) and completed orders (state=new/fulfilled) in the same ID space, the cart IDOR exposes data from all orders, not just active carts. The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

Weakness: CWE-639 (Authorization Bypass Through User-Controlled Key)

## Which versions are affected by CVE-2026-31820?

6 open source packages ship an affected version, including sylius/sylius. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `sylius/sylius` | Packagist | From 2.0.0 | 2.0.16 |
| `sylius/sylius` | Packagist | From 2.0.0 | 2.0.16 |
| `sylius/sylius` | Packagist | From 2.1.0 | 2.1.12 |
| `sylius/sylius` | Packagist | From 2.1.0 | 2.1.12 |
| `sylius/sylius` | Packagist | From 2.2.0 | 2.2.3 |
| `sylius/sylius` | Packagist | From 2.2.0 | 2.2.3 |

Products: Sylius Sylius.

## How do I fix CVE-2026-31820?

Upgrade sylius/sylius to a fixed version for your release line: 2.0.16, 2.1.12 or 2.2.3.

## Is CVE-2026-31820 being exploited?

There is no known exploitation of CVE-2026-31820 in the wild and no public exploit code.

## Other vulnerabilities in Sylius

- [CVE-2026-31824](https://insights.sbomify.com/CVE-2026-31824/): Sylius has a Promotion Usage Limit Bypass via Race Condition (high 8.2)
- [CVE-2024-57610](https://insights.sbomify.com/CVE-2024-57610/): Denial of service in n/a (high 7.5)
- [CVE-2022-24743](https://insights.sbomify.com/CVE-2022-24743/): Insufficient Session Expiration in Sylius (high 7.1)
- [CVE-2026-31819](https://insights.sbomify.com/CVE-2026-31819/): Sylius has an Open Redirect via Referer Header (medium 6.9)
- [CVE-2026-31821](https://insights.sbomify.com/CVE-2026-31821/): Sylius is Missing Authorization in API v2 Add Item Endpoint (medium 6.9)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-31820 and fix it if it is affected.

What it is: CVE-2026-31820 is a high-severity missing authorization vulnerability in Sylius, published on 10 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-31820 in the wild and no public exploit code.

Affected packages and fixed versions:
- sylius/sylius (Packagist): affected from 2.0.0; fixed in 2.0.16
- sylius/sylius (Packagist): affected from 2.0.0; fixed in 2.0.16
- sylius/sylius (Packagist): affected from 2.1.0; fixed in 2.1.12
- sylius/sylius (Packagist): affected from 2.1.0; fixed in 2.1.12
- sylius/sylius (Packagist): affected from 2.2.0; fixed in 2.2.3
- sylius/sylius (Packagist): affected from 2.2.0; fixed in 2.2.3

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-31820/ (Markdown: https://insights.sbomify.com/CVE-2026-31820/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-31820
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31820
- OSV: https://osv.dev/vulnerability/CVE-2026-31820

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-31820/
Summaries are generated and may contain mistakes; the official description above is the record.