CVE-2026-53637: 
PHP vulnerability analysis and mitigation

CVE-2026-53637 is a race condition vulnerability in the Sylius e-commerce platform's Cart FormComponent (Twig LiveComponent) that allows authenticated users to modify or permanently delete already-completed orders. The flaw affects sylius/sylius versions 2.0.0–2.0.17, 2.1.0–2.1.14, and 2.2.0–2.2.5. It was first published by Sylius on June 2, 2026, and added to the GitHub Advisory Database on July 9, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Sylius Advisory).

The root cause is a stale-state issue in the Sylius FormComponent LiveComponent (CWE-672: Operation on a Resource after Expiration or Release; CWE-841: Improper Enforcement of Behavioral Workflow). When a user has the cart page open and the underlying order transitions to a completed state (e.g., payment finalized in another tab or an admin changes the status), the LiveComponent retains a reference to the now-completed order without re-validating its checkout state. Subsequent cart actions — clearCart(), removeItem(), or saveCart() — operate directly on the completed order object without checking OrderCheckoutStates::STATE_COMPLETED, allowing the attacker to trigger manager->remove() (permanent deletion), item mutation, or quantity overwrite on a paid order. The fix introduces a hydrateResource() check that returns a fresh empty cart if the resolved order is already in the completed state (GitHub Advisory, Sylius Advisory).

Successful exploitation results in irreversible integrity loss of order data: a completed, paid order can be permanently deleted from the database, have its items removed, or have quantities overwritten — all without any corresponding refund or business logic enforcement. This can cause financial discrepancies between payment records and order records, disrupt fulfillment workflows, and undermine customer trust. There is no confidentiality or availability impact, but the integrity impact is rated High given the permanent and unrecoverable nature of the data corruption (GitHub Advisory).

Exploitation requires a low-privilege authenticated customer account and no user interaction beyond normal browser usage, making it accessible to any registered shop customer. The attack can occur accidentally (race condition between tabs) or be triggered deliberately by keeping the cart page open, completing checkout in a second tab, and then manipulating the stale cart. No public exploit code or exploit kits have been identified, and there is no evidence of in-the-wild exploitation or threat actor attribution at this time. The CVE status is listed as Reserved, and no EPSS score or CISA KEV listing is currently available (GitHub Advisory, Sylius Advisory).

1. Authenticate: Log in to a vulnerable Sylius storefront (versions 2.0.0–2.0.17, 2.1.0–2.1.14, or 2.2.0–2.2.5) as a registered customer with items in the cart.
2. Open cart page: Navigate to the cart page in Browser Tab A. The LiveComponent loads and holds a reference to the active order ID.
3. Complete checkout: In Browser Tab B, proceed through checkout and finalize payment, transitioning the order to STATE_COMPLETED. Do not refresh Tab A.
4. Trigger stale-state action in Tab A: In Tab A (still showing the old cart), perform one of the following:
   • Click "Clear Cart" → triggers clearCart() → manager->remove() permanently deletes the completed order from the database.
   • Click "Remove Item" → triggers removeItem() → mutates an item on the completed order.
   • Change item quantity → triggers saveCart() → overwrites order data with modified quantities.
5. Observe impact: The completed, paid order is now corrupted or deleted from the database, with no corresponding reversal of payment or fulfillment records (GitHub Advisory, Sylius Advisory).

• Logs: Application logs showing clearCart, removeItem, or saveCart LiveComponent actions fired against an order ID whose checkoutState is STATE_COMPLETED; Doctrine ORM logs recording DELETE statements on orders with a completed checkout state.
• Database: Missing order records for transactions that have corresponding payment confirmations; order items with quantities or contents inconsistent with the original payment amount.
• Application Events: SyliusCartEvents::CART_CLEAR or SyliusCartEvents::CART_ITEM_REMOVE events dispatched for orders in completed state, visible in event dispatcher logs if debug logging is enabled.
• Behavioral: A customer account that has a payment record but no associated order record, or an order record with quantities exceeding what was paid for (GitHub Advisory).

Sylius has released patched versions 2.0.18, 2.1.15, and 2.2.6; upgrading to one of these versions is the recommended remediation (GitHub Advisory). For operators unable to upgrade immediately, Sylius provides a manual workaround: create a patched src/Twig/Component/Cart/FormComponent.php that overrides hydrateResource() to return a new empty cart when the resolved order is in STATE_COMPLETED, then override the sylius_shop.twig.component.cart.form service definition in config/services.yaml to use the patched class, and finally clear the cache with bin/console cache:clear (Sylius Advisory).

The vulnerability was responsibly disclosed by Kévin Gonella (@kgonella) and Sam V., and Sylius acknowledged their contributions in the advisory. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (Sylius Advisory).