CVE-2026-115937

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...