Sylius is Missing Authorization in API v2 Add Item Endpoint

The POST /api/v2/shop/orders/{tokenValue}/items endpoint in Sylius API v2 lacks ownership verification. This allows an unauthenticated attacker to add items to any registered customer's cart by simply knowing the cart's tokenValue [1][2].

An attacker who obtains a cart tokenValue (e.g., via theft or leakage) can send a POST request with arbitrary product items. No authentication is required. The endpoint returns the full cart representation in the HTTP 201 response, potentially leaking sensitive data such as customer email, cart contents, addresses, payment and shipment IDs, order totals, and checkout state [2].

This flaw enables unauthorized addition of items to other customers' carts, leading to potential denial of service, data exposure, and manipulation of orders. The lack of ownership check on this mutation endpoint contrasts with other operations (PUT, PATCH, DELETE) which properly verify ownership via VisitorBasedExtension [2].

The issue is fixed in Sylius versions 2.0.16, 2.1.12, and 2.2.3 [1][2]. Users are advised to upgrade. A workaround is available by adding an ownership check in AddItemToCartHandler [2].