CVE-2026-53638: 
PHP vulnerability analysis and mitigation

CVE-2026-53638 is a channel-based payment method restriction bypass vulnerability in the Sylius e-commerce platform's shop account API. An authenticated customer can assign any globally enabled payment method to a placed, unpaid order — including methods explicitly excluded by the store operator for that sales channel. The vulnerability affects Sylius versions 2.0.0–2.0.17, 2.1.0–2.1.14, and 2.2.0–2.2.5. It was first published on June 2, 2026, and added to the GitHub Advisory Database on July 9, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Sylius Advisory).

The root cause is Incorrect Authorization (CWE-863): the PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint in the shop account API does not validate whether the requested payment method is enabled for the order's associated sales channel. By contrast, the equivalent checkout endpoint (PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}) correctly enforces this restriction and returns HTTP 422 for out-of-channel payment methods. The account endpoint silently accepts such requests and returns HTTP 200, allowing the bypass. Exploitation requires only a valid authenticated customer session and knowledge of a globally enabled payment method code (GitHub Advisory, Sylius Advisory).

Successful exploitation allows an authenticated customer to circumvent merchant-defined payment method restrictions on a per-channel basis, assigning payment methods to their orders that the store operator has deliberately disabled for that channel. The primary impact is on integrity — business logic and payment configuration controls are undermined — while there is no direct confidentiality or availability impact. This could enable customers to exploit payment methods with different fee structures, fraud controls, or terms not intended for a given storefront, potentially causing financial or operational harm to the merchant (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-53638. The vulnerability requires low privileges (an authenticated shop customer account) and has low attack complexity, making it straightforward to exploit for any registered customer on a vulnerable Sylius store. No CISA KEV listing or threat actor attribution has been identified. The CVE status is listed as Reserved, and no EPSS score data is currently available (GitHub Advisory, Sylius Advisory).

1. Authenticate: Log in to the Sylius storefront as a registered customer to obtain a valid session token.
2. Place an order: Complete the checkout process up to payment, leaving the order in STATE_NEW (placed but not yet paid).
3. Identify a restricted payment method: Determine the code of a globally enabled payment method that is not configured for the current sales channel (e.g., via API enumeration or knowledge of the store's configuration).
4. Send the bypass request: Issue a PATCH request to /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} with the restricted payment method code in the request body, using the authenticated session credentials.
5. Confirm bypass: Observe that the server returns HTTP 200 and the order's payment method has been updated to the restricted method, bypassing the channel-level restriction (GitHub Advisory).

• Network/API Logs: Unexpected PATCH requests to /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} returning HTTP 200 with payment method codes not configured for the relevant sales channel.
• Application Logs: Orders in STATE_NEW with payment methods that do not match the channel's enabled payment method list, detectable via Sylius admin order review or database audit.
• Database: Payment records on orders referencing payment method IDs not associated with the order's channel configuration.

Sylius has released patched versions 2.0.18, 2.1.15, and 2.2.6, which enforce channel-based payment method validation on the account orders API endpoint. Upgrading to one of these versions is the recommended remediation. For operators unable to upgrade immediately, Sylius provides a workaround: decorate the Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface service with a custom ChannelCheckingPaymentMethodChanger class that validates the payment method against the channel before delegating to the original implementation, then register it in config/services.yaml and clear the cache with bin/console cache:clear (GitHub Advisory, Sylius Advisory).

The vulnerability was responsibly disclosed by Fredrik Dietrichson (@FredrikEV), who is credited in the official Sylius security advisory. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (Sylius Advisory).