CVE-2026-115937

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...

CVE-2026-115937

The Mollie webhook endpoint in Craft Commerce is vulnerable to an unauthenticated payment reuse flaw due to insufficient verification of data authenticity (CWE-345). The application fails to verify that the commerceTransactionHash and id parameters belong together. An unauthenticated attacker pos...

CVE-2026-115937 Unauthenticated payment reuse allows unpaid orders to be marked as paid

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...