View Ridge Security
Back to Cyber Hose

Multiple High-Severity Sylius Vulnerabilities Affecting Payments

Sylius versions before 2.1.16 and 2.2.9 have critical flaws including payment overwrite and admin password reset issues.

🔓 CVEs & KEV

  • CVE-2026-100872 — Sylius — CVSS 8.7 — Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount OverwriteSylius versions be...

  • CVE-2026-100871 — Sylius — CVSS 8.7 — Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confu...

  • CVE-2026-100870 — Sylius — CVSS 8.7 — Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Res...

  • CVE-2026-100869 — Sylius — CVSS 8.2 — Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop APISyliu...

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check