UpHeron
All vulnerabilities

Servers and applications

GHSA-cqw6-3fwg-cfv4

Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data

Severity
High 8.1
Published
22 Oct 2026
Last changed
22 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
2.1.17, 2.2.12, 2.3.2
Sources
Project advisories (GitHub)

Affected software

SoftwareAffected versions
SyliusServers and applications · github:sylius/sylius
  • From 2.0.0 up to 2.0.18
  • From 2.1.0 before 2.1.17
  • From 2.2.0 before 2.2.12
  • From 2.3.0 before 2.3.2

References