CVE-2026-115937

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash. Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/craftcms/commerce-mollie
https://github.com/craftcms/commerce-mollie/releases/tag/4.4.3
https://github.com/craftcms/commerce-mollie/security/advisories/GHSA-3qcx-mjf6-48vj
https://www.hckrt.com/hacktivity/HCKRT-6RB2BC

Configurations

No configuration.

History

23 Oct 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-23 22:16

Updated : 2026-10-26 18:39

NVD link : CVE-2026-115937

Mitre link : CVE-2026-115937

CVE.ORG link : CVE-2026-115937

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-115937", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "affectedData": [{"vendor": "craftcms", "product": "commerce-mollie", "versions": [{"status": "affected", "version": "2.1.1", "lessThan": "4.4.3", "versionType": "semver"}], "packageName": "craftcms/commerce-mollie", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}]}], "published": "2026-10-23T22:16:59.453", "references": [{"url": "https://github.com/craftcms/commerce-mollie", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}, {"url": "https://github.com/craftcms/commerce-mollie/releases/tag/4.4.3", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}, {"url": "https://github.com/craftcms/commerce-mollie/security/advisories/GHSA-3qcx-mjf6-48vj", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}, {"url": "https://www.hckrt.com/hacktivity/HCKRT-6RB2BC", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:\n\n * commerceTransactionHash\u00a0\u2014 selects which Craft Commerce transaction is completed\n * id\u00a0\u2014 selects which Mollie payment is queried for its status\n\n\n\n\nAn unauthenticated attacker holding any paid Mollie payment ID from the merchant\u2019s account can pair it with any transaction hash.\n\n\n\nCommerce queries Mollie, sees\u00a0status: paid, and marks the target transaction successful for that transaction\u2019s full\namount, regardless of how much was actually paid."}], "lastModified": "2026-10-26T18:39:42.503", "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}