CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...