{"id":"CVE-2026-115937","kind":"vulnerability","aliases":["CVE-2026-115937"],"related":[],"title":"Craft Commerce: Mollie webhook marks unpaid orders successful without verification","description":"The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:\n\n  *  commerceTransactionHash — selects which Craft Commerce transaction is completed\n  *  id — selects which Mollie payment is queried for its status\n\n\n\n\nAn unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.\n\n\n\nCommerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full\namount, regardless of how much was actually paid.","summary":"The Mollie webhook endpoint in Craft Commerce accepts a transaction hash and a Mollie payment ID without checking that they belong together. An unauthenticated attacker holding any paid Mollie payment ID from the merchant's account can mark any transaction as paid for its full amount.","severity":"high","cvss":8.7,"epss":0.00249,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","craft-commerce","e-commerce","mollie","package","php"],"not_affected_if":["mollie-gateway-disabled"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T22:16:59+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","triaged_at":"2026-10-25T03:00:00+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:00:00Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Craft Commerce: Mollie webhook marks unpaid orders successful without verification","impact":"high","summary":"The Mollie webhook endpoint in Craft Commerce accepts a transaction hash and a Mollie payment ID without checking that they belong together. An unauthenticated attacker holding any paid Mollie payment ID from the merchant's account can mark any transaction as paid for its full amount.","category":"package","nicknames":[],"who_cares":["craft-cms","craft-commerce","mollie","php","e-commerce"],"confidence":0.6,"needs_auth":"no","worst_case":"Orders are marked paid without payment, causing financial loss for the merchant.","analyst_note":"Find the affected and fixed Craft Commerce and Mollie plugin versions and the patch location, using the NVD entry linked in the sources.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["mollie-gateway-disabled"],"who_is_affected":"Stores running Craft Commerce with the Mollie payment gateway enabled and an exposed webhook endpoint are exposed. The sources do not name the affected Craft Commerce or Mollie plugin versions. Stores that do not use the Mollie gateway can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000581,"input_tokens":3404,"output_tokens":481,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115937':13A,16A '-2026':12A,15A 'accept':36B,79C 'account':64B,124C 'actual':155C 'amount':74B,149C 'attack':53B,83C,113C 'attacker-control':82C 'belong':49B,91C 'check':46B 'cms':19B 'commerc':2A,22B,25B,35B,97C,132C 'commercetransactionhash':93C 'complet':100C 'control':84C 'craft':1A,18B,21B,34B,96C 'craft-cm':17B 'craft-commerc':20B 'cve':11A,14A 'e':24B 'e-commerc':23B 'endpoint':32B,78C 'full':73B,148C 'hash':39B,131C 'hold':54B,114C 'id':44B,59B,101C,119C 'independ':81C 'mark':5A,66B,139C 'merchant':62B,122C 'molli':3A,26B,30B,42B,57B,76C,104C,117C,134C 'much':153C 'never':87C 'order':7A 'packag':27B 'paid':56B,70B,116C,137C,156C 'pair':126C 'paramet':85C 'payment':43B,58B,105C,118C 'php':28B 'queri':107C,133C 'regardless':150C 'see':135C 'select':94C,102C 'status':110C,136C 'success':8A,143C 'target':141C 'togeth':50B,92C 'transact':38B,68B,98C,130C,142C,146C 'two':80C 'unauthent':52B,112C 'unpaid':6A 'verif':10A 'verifi':88C 'webhook':4A,31B,77C 'without':9A,45B","nicknames":[],"mitigations":[],"who_affected":"Stores running Craft Commerce with the Mollie payment gateway enabled and an exposed webhook endpoint are exposed. The sources do not name the affected Craft Commerce or Mollie plugin versions. Stores that do not use the Mollie gateway can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T22:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"7004884b-51e2-48e8-b4a2-5ca29e80453e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115937","severity":null,"published_at":"2026-10-23T22:16:59+00:00","modified_at":"2026-10-23T22:16:59+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115937","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115937","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}