This vulnerability is an Insecure Direct Object Reference within Sylius's LiveComponent mapping. Authenticated users can supply arbitrary resource identifiers through #[LiveArg] parameters. The framework then loads the corresponding entity with ->find() without checking that the resource belongs to the requesting user. As a result, a malicious user can discover personal information—including first name, last name, company, phone number, street, city, postcode, and country—from other customers’ addresses, and can also read order totals, item counts, discounts, shipping costs, and tax details for any cart or completed order. The flaw originates from the lack of ownership validation for resource IDs, a classic CWE‑639 scenario.

The affected product is the Sylius eCommerce framework. Versions prior to 2.0.16, 2.1.12, and 2.2.3 are impacted. The bug resides in multiple LiveComponents such as Checkout address FormComponent, Cart widget, and Cart summary. All installations using a vulnerable Sylius release and enabling those components should treat this flaw as high risk.

The CVSS score of 7.1 indicates a moderate to high severity, while the EPSS score of less than 1% suggests that exploitation in the wild is currently unlikely; the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the weakness can be exploited by any authenticated user who can control LiveComponent arguments—most likely through the UI—by supplying arbitrary record identifiers. The attacker does not need elevated privileges; merely accessing the site with a user account suffices.