CVE-2026-53637
Description
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched FormComponent into the application's src/ directory and override the sylius_shop.twig.component.cart.form service definition to use that class.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sylius/syliusPackagist | >= 2.0.0, < 2.0.18 | 2.0.18 |
sylius/syliusPackagist | >= 2.1.0, < 2.1.15 | 2.1.15 |
sylius/syliusPackagist | >= 2.2.0, < 2.2.6 | 2.2.6 |
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.