The Sylius Shop Payment Request API endpoints GET /api/v2/shop/payment-requests/{hash} and PUT /api/v2/shop/payment-requests/{hash} do not verify that the authenticated customer owns the payment request identified by the UUID hash in the URL. Consequently, an attacker who obtains a payment request hash can access payment request details and retrieve the underlying order tokenValue, granting access to full order data including items, addresses, and customer email. The attacker can also modify the payment request payload fields such as target_path and after_path to redirect users to attacker-controlled URLs. The POST endpoint for creating payment requests similarly resolves orders by tokenValue without ownership verification. The vulnerability is fixed in Sylius versions 2.0.18, 2.1.15, and 2.2.6. Until upgrading, a workaround involves implementing a Doctrine query extension to enforce ownership checks, restricting access to payment requests to their rightful owners or guest orders only.

An attacker who obtains a payment request UUID hash can read sensitive payment request and order information without authentication, including customer email and order details. They can also modify payment request redirect URLs to attacker-controlled destinations, potentially intercepting buyers after payment. The vulnerability allows unauthorized data disclosure and manipulation of payment request data. Exploitation requires out-of-band acquisition of the UUID hash but no further credentials or order tokens are needed. This poses a moderate risk of unauthorized access and redirection attacks.

Official patches fixing this vulnerability are available in Sylius versions 2.0.18, 2.1.15, and 2.2.6. Users should upgrade to these or later versions to remediate the issue. Until upgrading, apply the provided workaround by implementing a query extension that enforces ownership checks on payment request API endpoints, ensuring that authenticated users can only access their own payment requests and anonymous users can only access guest orders. This workaround prevents unauthorized access and modification of payment requests.