Sylius contains an authorization bypass vulnerability (CVE-2026-53638) in its shop account API where the PATCH endpoint for modifying payment methods on placed but unpaid orders does not verify that the selected payment method is enabled for the order's channel. This allows authenticated customers to assign any globally enabled payment method to their orders, including those explicitly excluded from the channel. The equivalent checkout endpoint correctly enforces channel restrictions. The vulnerability affects Sylius versions >=2.0.0 <2.0.18, >=2.1.0 <2.1.15, and >=2.2.0 <2.2.6. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6 and later. A recommended workaround is to decorate the PaymentMethodChangerInterface service to add channel validation until the patch can be applied.

An authenticated customer can bypass channel-based payment method restrictions on their own placed orders that are not yet paid, potentially using payment methods the store operator has excluded from the order's channel. This could lead to unintended payment method usage but does not affect confidentiality or availability.

A fix is available in Sylius versions 2.0.18, 2.1.15, 2.2.6 and above. Users should upgrade to these versions to remediate the vulnerability. If immediate upgrade is not possible, users can implement the provided workaround by decorating the PaymentMethodChangerInterface service to enforce channel-based payment method validation. This decorator throws a validation exception if the payment method is not supported by the order's channel, effectively mitigating the issue.