The Sylius Mollie Plugin integrates Mollie payment services into Sylius applications. Before versions 2.2.8, 3.2.4, and 3.3.1, the GET endpoints /{_locale}/thank-you and /{_locale}/get-code retrieve order information based on sequential orderId values without verifying user ownership or session context. This lack of authorization checks allows attackers to enumerate order IDs and obtain tokenValue values. These tokens can then be used with the /{_locale}/register-after-checkout/{tokenValue} endpoint to access customer first name, last name, and email, constituting an authorization bypass vulnerability classified as CWE-639. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can access personal customer information (first name, last name, email) by exploiting the lack of authorization checks on certain endpoints. This exposure of customer data constitutes a confidentiality breach. There is no indication of integrity or availability impact beyond limited availability impact noted in CVSS. No known exploits are reported in the wild.

Upgrade Sylius Mollie Plugin to version 2.2.8, 3.2.4, or 3.3.1 or later where the authorization checks have been implemented to prevent unauthorized access to order tokens and customer information. Patch status is confirmed by the vendor's versioning. No additional mitigation is indicated.