Advisories for Composer/Sylius/Mollie-Plugin package

The shop payment webhook POST /{_locale}/update-payment (route sylius_mollie_shop_payment_webhook) accepts two independent, attacker-controlled parameters: id (the Mollie payment ID, verified against Mollie's API) and orderId (the Sylius order ID, read directly from the database). The handler never verifies that the Mollie payment belongs to the referenced order. An unauthenticated attacker who holds any valid paid Mollie payment ID, for example from a EUR 1 order they placed themselves, can submit it …

Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /{_locale}/thank-you (PageRedirectController::thankYouAction, route sylius_mollie_shop_thank_you_page_redirect) loads the order with findOneBy(['id' => $orderId]) and returns a 302 whose Location header carries that order's tokenValue. Any orderId thus yields that order's token. A non-existent id dereferences null and returns a 500. The handler also writes the raw orderId …