---
id: CVE-2026-108724
title: >-
  Sylius through 2.3.0 contains an authorization bypass vulnerability that
  allows unauthenticated attackers to read unmoderated and rejected product
  reviews because the AcceptedExtension filter is not applied to the item
  operation
summary: >-
  Sylius through 2.3.0 contains an authorization bypass vulnerability that
  allows unauthenticated attackers to read unmoderated and rejected product
  reviews because the AcceptedExtension filter is not applied to the item
  operation. Attacke…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: Sylius
product: Sylius
affected:
  - Sylius <= 2.3.0
published: '2026-10-11'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:18:44.867'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108724'
references:
  - url: 'https://github.com/Sylius/Sylius'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Doctrine/ORM/QueryExtension/Shop/ProductReview/AcceptedExtension.php#L25-L59
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Resources/config/services/extensions.php#L63-L67
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind/sylius-shop-product-review-item-moderation-bypass'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/sylius-through-2.3.0-authorization-bypass-via-shop-api-product-review-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00323
epssPercentile: 0.25115
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-14T13:24:36.142449Z'
ingestedAt: '2026-10-11T13:51:17.028Z'
---

## Overview

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.