CVE-2026-100871

Summary

The flaw allows attackers to obtain an administrator's token by registering a shop customer account with an administrator's email, granting full administrative access. This is due to the lack of firewall identification in JWT tokens issued by separate Admin and Shop API endpoints.

Exploitability

Exploitation is relatively straightforward if an attacker can register a shop customer account with an administrator's email. Precondition is access to the Shop API registration endpoint.

Blast radius

If exploited, this could result in unauthorized administrative access and potential full control over the Sylius instance.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Sylius version 1.12.25 or later, 1.13.17 or later, 1.14.20 or later, 2.1.16 or later, or 2.2.9 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.