CVE-2021-32720

Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time. The problem has been patched at Sylius 1.9.5 and 1.10.0-RC.1. There are a few workarounds for the vulnerability. The first possible solution is to hide the problematic endpoints behind the firewall from not logged in users. This would put only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it will have access to theirs orders only. The second possible solution is to decorate the `\Sylius\Bundle\ApiBundle\Doctrine\QueryCollectionExtension\OrdersByLoggedInUserExtension` and throw `Symfony\Component\Security\Core\Exception\AccessDeniedException` if the class is executed for unauthorized user.

• CWE-200
• CWE-200

• https://github.com/Sylius/Sylius/releases/tag/v1.9.5Release Notes, Third Party Advisory
• https://github.com/Sylius/Sylius/security/advisories/GHSA-rpxh-vg2x-526vMitigation, Third Party Advisory
• https://github.com/Sylius/Sylius/releases/tag/v1.9.5Release Notes, Third Party Advisory
• https://github.com/Sylius/Sylius/security/advisories/GHSA-rpxh-vg2x-526vMitigation, Third Party Advisory

Published

Jun 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32715hyper is an HTTP library for rust. hyper's HTTP/1 server cod…5.3
• CVE-2021-32716Shopware is an open source eCommerce platform. In versions p…4.9
• CVE-2021-32717Shopware is an open source eCommerce platform. In versions p…7.5
• CVE-2021-32718RabbitMQ is a multi-protocol messaging broker. In rabbitmq-s…5.4
• CVE-2021-32719RabbitMQ is a multi-protocol messaging broker. In rabbitmq-s…4.8
• CVE-2021-3272jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 ha…5.5
• CVE-2021-32721PowerMux is a drop-in replacement for Go's http.ServeMux. In…6.1
• CVE-2021-32722GlobalNewFiles is a mediawiki extension. Versions prior to 4…6.5
• CVE-2021-32723Prism is a syntax highlighting library. Some languages befor…6.5
• CVE-2021-32724check-spelling is a github action which provides CI spell ch…9.9
• CVE-2021-32725Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32726Nextcloud Server is a Nextcloud package that handles data st…9.8