Live › vulnerability › CVE-2026-115937
Go to dashboardThe Mollie webhook endpoint in Craft Commerce accepts a transaction hash and a Mollie payment ID without checking that they belong together. An unauthenticated attacker holding any paid Mollie payment ID from the merchant's account can mark any transaction as paid for its full amount.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 23:44 UTC. All times on this page are UTC.
Stores running Craft Commerce with the Mollie payment gateway enabled and an exposed webhook endpoint are exposed. The sources do not name the affected Craft Commerce or Mollie plugin versions. Stores that do not use the Mollie gateway can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:
An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.
Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.
This page as .md · .json · in your agent: get_signal("CVE-2026-115937")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.