CVE-2026-31820

CVE-2026-31820 is an authenticated Insecure Direct Object Reference (IDOR) vulnerability affecting Sylius, an Open Source eCommerce Framework, specifically within its LiveComponents. This flaw allows an authenticated attacker to access sensitive personal and order information belonging to other users by manipulating unvalidated resource IDs. Rated Medium with a CVSS score of 6.5, the vulnerability has a network attack vector and low attack complexity, requiring only low privileges for exploitation. It leads to a high impact on confidentiality, exposing data such as names, addresses, phone numbers, and full order details from both active carts and completed orders. While there is no evidence of active exploitation, nor public exploit code available, the vulnerability has been publicly disclosed and discussed in one article, necessitating updates to Sylius versions 2.0.16, 2.1.12, 2.2.3, or higher.