CVE-2026-31821 Sylius is Missing Authorization in API v2 Add Item Endpoint
Unauthenticated attackers can add items to other customers' carts by exploiting missing ownership verification in the Sylius API v2 add item endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31821?
CVE-2026-31821 is a medium-severity missing authorization vulnerability in Sylius, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer's cart. The endpoint returns the full cart representation in the response (HTTP 201). The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.
Weakness: CWE-862
Which versions are affected by CVE-2026-31821?
6 open source packages ship an affected version, including sylius/sylius. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sylius/sylius Packagist | From 2.0.0 | 2.0.16 |
sylius/sylius Packagist | From 2.0.0 | 2.0.16 |
sylius/sylius Packagist | From 2.1.0 | 2.1.12 |
sylius/sylius Packagist | From 2.1.0 | 2.1.12 |
sylius/sylius Packagist | From 2.2.0 | 2.2.3 |
sylius/sylius Packagist | From 2.2.0 | 2.2.3 |
Products include Sylius Sylius.
How do I fix CVE-2026-31821?
Upgrade sylius/sylius to a fixed version for your release line: 2.0.16, 2.1.12 or 2.2.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-31821 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31821 exists.
Other vulnerabilities in Sylius
- CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition
- CVE-2024-57610 Denial of service in n/a
- CVE-2026-31820 Sylius affected by IDOR in Cart and Checkout LiveComponents
- CVE-2022-24743 Insufficient Session Expiration in Sylius
- CVE-2026-31819 Sylius has an Open Redirect via Referer Header
Sources
Also known as GHSA-wjmg-4cq5-m8hg.