CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order
Authenticated users can modify or delete completed orders due to improper workflow enforcement in the cart component.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53637?
CVE-2026-53637 is a medium-severity vulnerability in Sylius, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.
Which versions are affected by CVE-2026-53637?
6 open source packages ship an affected version, including sylius/sylius.
| Package | Affected | Fixed in |
|---|---|---|
sylius/sylius Packagist | From 2.0.0 | 2.0.18 |
sylius/sylius Packagist | From 2.0.0 | 2.0.18 |
sylius/sylius Packagist | From 2.1.0 | 2.1.15 |
sylius/sylius Packagist | From 2.1.0 | 2.1.15 |
sylius/sylius Packagist | From 2.2.0 | 2.2.6 |
sylius/sylius Packagist | From 2.2.0 | 2.2.6 |
How do I fix CVE-2026-53637?
Upgrade sylius/sylius to a fixed version for your release line: 2.0.18, 2.1.15 or 2.2.6.
Is CVE-2026-53637 being exploited?
There is no known exploitation of CVE-2026-53637 in the wild and no public exploit code.
Sources
Also known as GHSA-5597-7rmh-97q5.