CVE-2026-115937

The Mollie webhook endpoint in Craft Commerce is vulnerable to an unauthenticated payment reuse flaw due to insufficient verification of data authenticity (CWE-345). The application fails to verify that the commerceTransactionHash and id parameters belong together. An unauthenticated attacker pos...

CVE-2026-115937 Unauthenticated payment reuse allows unpaid orders to be marked as paid

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the syliusmollieshoppaymentwebhook process. An attacker can manipulate the payment status of any order by submitting a valid Mollie payment ID together with a victim's order ID, causi...