CVE-2026-115937
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-345
Verificación insuficiente de autenticidad de los datos
Fecha de publicación:
23/10/2026
Última modificación:
26/10/2026
Descripción
*** Pendiente de traducción *** The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:<br />
<br />
* commerceTransactionHash — selects which Craft Commerce transaction is completed<br />
* id — selects which Mollie payment is queried for its status<br />
<br />
<br />
<br />
<br />
An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.<br />
<br />
<br />
<br />
Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full<br />
amount, regardless of how much was actually paid.
Impacto
Puntuación base 4.0
8.70
Gravedad 4.0
ALTA
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA