CVE-2026-100871
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
287
Improper Authentication
DraftCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Access Control
Potential Impacts:
Read Application Data
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based, ICS/OT
https://github.com/Sylius/Sylius
https://github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45c
https://github.com/Sylius/Sylius/pull/19213
https://github.com/Sylius/Sylius/releases/tag/v2.2.9
https://github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xf
https://www.vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.…