https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 16:48:25 +0000 https://cve.radiocsirt.org/vuln/cve-2026-31821 <p><strong>Affected:</strong> Sylius</p> <p>Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers&#39; carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer&#39;s cart. The endpoint returns the full cart representation in the response (HTTP 201). The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.</p> <p><strong>Affected:</strong> Sylius</p> <p>Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers&#39; carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer&#39;s cart. The endpoint returns the full cart representation in the response (HTTP 201). The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.</p> https://cve.radiocsirt.org/vuln/cve-2026-31821