CVE-2026-53637

The record

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

Affected packages

Related vulnerabilities

• CVE-2026-98124 In the Linux kernel, the following vulnerability has been resolved: smb/client… CWE-672
• CVE-2026-98080 In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force… CWE-672
• CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0… CWE-672
• CVE-2026-61699 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-672
• CVE-2026-85044 Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82… CWE-672
• CVE-2026-19538 The BLOCKED access control list items that are evaluated to deny access on the the proxy… CWE-672
• CVE-2026-79010 Operation on a resource after expiration or release in Network in Google Chrome prior to… CWE-672
• CVE-2026-52733 ZEBRA is a Zcash node written entirely in Rust. CWE-672