CVE-2026-31821: 
PHP vulnerability analysis and mitigation

CVE-2026-31821 is a Missing Authorization vulnerability in Sylius, an open-source eCommerce framework built on Symfony, affecting the POST /api/v2/shop/orders/{tokenValue}/items endpoint. The flaw allows unauthenticated attackers to add items to other registered customers' carts by knowing the cart's tokenValue, and the response leaks sensitive cart data. Affected versions include 2.0.0–2.0.15, 2.1.0–2.1.11, and 2.2.0–2.2.2. It was published on March 9, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Sylius Advisory).

The root cause is CWE-862 (Missing Authorization): the AddItemToCartHandler command handler does not verify that the requesting user owns the cart identified by tokenValue before adding items. In contrast, other mutation endpoints (PUT, PATCH, DELETE) are not affected because API Platform loads the Order entity through a state provider that triggers VisitorBasedExtension, returning HTTP 404 for unauthorized users — a protection absent from the POST add-item flow. An attacker needs only a valid tokenValue (obtainable through various means such as URL leakage, referrer headers, or social engineering) and network access to the API; no authentication, special privileges, or user interaction is required (Sylius Advisory, Github Advisory).

A successful exploit allows an attacker to add arbitrary items to another customer's cart without authorization, and the HTTP 201 response exposes the full cart representation including the customer's email address, cart contents (products, quantities, prices), billing and shipping address data, payment and shipment IDs, order totals, tax breakdown, and checkout state. While availability is not impacted and the attacker cannot directly modify or delete existing cart contents, the data exposure constitutes a meaningful confidentiality breach and the unauthorized cart modification undermines cart integrity. This could be used for targeted phishing, competitive intelligence, or harassment of specific customers (Sylius Advisory, Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.05–0.112%, placing it in roughly the 29th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Despite the low EPSS, the ease of exploitation — requiring only network access and a known tokenValue with no authentication — makes it a straightforward target if token values are exposed (Github Advisory).

1. Reconnaissance: Identify a Sylius-powered eCommerce site running API v2 (versions 2.0.0–2.0.15, 2.1.0–2.1.11, or 2.2.0–2.2.2). Confirm the /api/v2/shop/orders/ endpoint is accessible.
2. Obtain a cart tokenValue: Acquire a target customer's cart tokenValue through methods such as intercepting shared URLs, referrer header leakage, social engineering, or by observing cart links shared publicly (e.g., in support tickets or screenshots).
3. Craft the malicious request: Send an unauthenticated HTTP POST request to POST /api/v2/shop/orders/{tokenValue}/items with a JSON body specifying a valid product variant code and quantity:

POST /api/v2/shop/orders/TARGET_TOKEN/items
Content-Type: application/json

{"productVariant": "/api/v2/shop/product-variants/VARIANT_CODE", "quantity": 1}

4. Harvest leaked data: Parse the HTTP 201 response body, which contains the full cart representation including the victim's email address, cart contents, address data, payment/shipment IDs, and order totals.
5. Repeat or escalate: Repeat the process for additional tokenValues to enumerate multiple customer carts, or use the harvested PII for downstream attacks such as phishing (Sylius Advisory, Github Advisory).

• Network: Unusual or high-volume unauthenticated POST requests to /api/v2/shop/orders/*/items from unexpected IP addresses or without a corresponding authenticated session; requests originating from IPs not associated with any known customer account.
• Logs: Web server or application logs showing repeated POST requests to /api/v2/shop/orders/{tokenValue}/items returning HTTP 201 without an associated authenticated user session; requests using varied or sequential tokenValue patterns suggesting enumeration.
• Application Behavior: Cart contents of registered customers unexpectedly modified (items added) without corresponding customer activity; customer complaints about unexpected items appearing in their carts.

Sylius has released patched versions: 2.0.16, 2.1.12, and 2.2.3. Operators should upgrade to the appropriate patched version for their branch as the primary remediation. For those unable to upgrade immediately, the advisory provides a manual workaround: create a custom AddItemToCartHandler that injects UserContextInterface and calls an assertCartAccessible() method to verify the current user matches the cart owner before processing the request, then override the sylius_api.command_handler.cart.add_item_to_cart service in config/services.yaml and clear the cache with bin/console cache:clear (Sylius Advisory, Github Advisory).

The vulnerability was responsibly disclosed by researcher @rokorolov and acknowledged by the Sylius security team, who published a detailed advisory with both patch and workaround guidance. Sylius also published a security blog post covering the issue alongside other version fixes (Sylius Blog). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking and aggregation sites.