The POST /api/v2/shop/orders/{tokenValue}/items endpoint in Sylius fails to verify that the cart belongs to the caller. This flaw allows an unauthenticated attacker who knows a valid cart tokenValue to add arbitrary items to an existing customer’s shopping cart, effectively creating an unauthorized order. The vulnerability is an instance of improper authorization (CWE‑862) and can lead to financial loss or customer confusion if the altered cart is checked out.

The open source Sylius eCommerce framework on Symfony is affected in all releases prior to the following patches: 2.0.16, 2.1.12, and 2.2.3. These versions include the necessary authorization check; all later releases are considered secure.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % shows that exploitation is expected to be rare. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires knowledge of a specific cart tokenValue, widespread attacks are limited, but once a token is obtained, the attacker can immediately add items to the cart by sending a simple HTTP POST request.