CVE-2026-115937: CWE-345 Insufficient Verification of Data Authenticity in craftcms commerce-mollie

The vulnerability arises because the Mollie webhook endpoint accepts two independent parameters—commerceTransactionHash, which identifies the Craft Commerce transaction, and id, which identifies the Mollie payment—without verifying that these parameters correspond to the same transaction. An attacker who possesses any paid Mollie payment ID can pair it with any transaction hash, causing the system to query Mollie, receive a 'paid' status, and mark the targeted transaction as successfully paid for the full amount, potentially leading to unauthorized transaction completion.

An unauthenticated attacker can manipulate transaction completion status by pairing any paid Mollie payment ID with any transaction hash, causing the system to mark transactions as paid incorrectly. This can lead to financial loss due to fraudulent transaction completions without actual payment for those transactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Mollie webhook endpoints and monitor for suspicious transaction completions related to this vulnerability.