Threats tagged 'ghsa-6955-hrm5-c4qp'

An authorization bypass vulnerability exists in the Sylius shop account API endpoint that allows authenticated customers to assign payment methods to their orders that are not enabled for the order's sales channel. This occurs because the PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint does not validate channel restrictions on payment methods, unlike the equivalent checkout endpoint. The issue affects Sylius versions prior to 2.0.18, 2.1.15, and 2.2.6. A fix is available in these versions and above. A workaround involves decorating the PaymentMethodChangerInterface service to enforce channel checks.