{"id":"CVE-2026-31820","summary":"Sylius affected by IDOR in Cart and Checkout LiveComponents","details":"Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled - any action that accepts a resource ID via #[LiveArg] and loads it with -\u003efind() without ownership validation is vulnerable. Checkout address FormComponent (addressFieldUpdated action): Accepts an addressId via #[LiveArg] and loads it without verifying ownership, exposing another user's first name, last name, company, phone number, street, city, postcode, and country. Cart WidgetComponent (refreshCart action): Accepts a cartId via #[LiveArg] and loads any order directly from the repository, exposing order total and item count. Cart SummaryComponent (refreshCart action): Accepts a cartId via #[LiveArg] and loads any order directly from the repository, exposing subtotal, discount, shipping cost, taxes (excluded and included), and order total. Since sylius_order contains both active carts (state=cart) and completed orders (state=new/fulfilled) in the same ID space, the cart IDOR exposes data from all orders, not just active carts. The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.","aliases":["GHSA-2xc6-348p-c2x6"],"modified":"2026-04-10T05:42:10.652737Z","published":"2026-03-10T21:22:37.052Z","database_specific":{"cna_assigner":"GitHub_M","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31820.json","cwe_ids":["CWE-639"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31820.json"},{"type":"ADVISORY","url":"https://github.com/Sylius/Sylius/security/advisories/GHSA-2xc6-348p-c2x6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31820"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sylius/sylius","events":[{"introduced":"7aa47be3a617f75337d73d245352ea700bc8a1ef"},{"fixed":"111d96b1bea7cb59bc2f7b4c6d35d5cd05872195"}],"database_specific":{"versions":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}},{"type":"GIT","repo":"https://github.com/sylius/sylius","events":[{"introduced":"a5a816f9f1fcb5abd2d42b27801656aa2ae9bf0d"},{"fixed":"d8092f21ee9606b0155231fe892d9d54fc44986e"}],"database_specific":{"versions":[{"introduced":"2.1.0"},{"fixed":"2.1.12"}]}},{"type":"GIT","repo":"https://github.com/sylius/sylius","events":[{"introduced":"6dd3ca9895be7ab7e6cb71f37af2ef66af17cbe0"},{"fixed":"af579b0b6eaa10ea0883fb458484718c80fc96c7"}],"database_specific":{"versions":[{"introduced":"2.0.0"},{"fixed":"2.0.16"}]}}],"versions":["v2.0.0","v2.0.1","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.15","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.6","v2.0.7","v2.0.8","v2.0.9","v2.1.0","v2.1.1","v2.1.10","v2.1.11","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.6","v2.1.7","v2.1.8","v2.1.9","v2.2.0","v2.2.1","v2.2.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31820.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}