The Sylius Cart FormComponent does not properly handle state changes when an order is completed in the background (e.g., by an admin or payment finalization in another tab). The LiveComponent displaying the cart remains unaware of the order's completed state, allowing users to perform actions like clearing the cart, removing items, or changing quantities on an order that is already completed. These actions result in permanent deletion or corruption of the order data in the database. The vulnerability affects Sylius versions >=2.0.0 <2.0.18, >=2.1.0 <2.1.15, and >=2.2.0 <2.2.6. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6 and later.

An attacker or legitimate user can cause irreversible loss or corruption of completed order data by manipulating the cart page after the order has been finalized. This can lead to deletion of completed orders or unauthorized modification of order contents, potentially impacting order integrity and customer trust. There is no direct confidentiality or availability impact reported, but integrity is severely affected.

A fix is available in Sylius versions 2.0.18, 2.1.15, and 2.2.6 and above. Users should upgrade to these versions or later to resolve the issue. If immediate upgrade is not possible, a workaround involves creating a patched copy of the affected Cart FormComponent class in the application source directory and overriding the Sylius service definition to use the patched class, as detailed in the vendor advisory.