Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

Impact The shop payment webhook POST /locale/update-payment route syliusmollieshoppaymentwebhook accepts two independent, attacker-controlled parameters: id the Mollie payment ID, verified against Mollie's API and orderId the Sylius order ID, read directly from the database. The handler never...

CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to...