CVE-2026-115937 craftcms CVE debrief

Who should care

Defenders of Craft Commerce and Mollie payment integrations should assess exposure and potential impact. This includes security teams, vulnerability management teams, and operators responsible for maintaining and securing these integrations. They should verify exposure, assess potential impact, and implement compensating controls to monitor and validate transaction statuses.

Why it matters

CVE-2026-115937 allows unauthenticated attackers to manipulate transaction statuses, potentially leading to financial losses

• Unauthenticated attackers can pair any paid Mollie payment ID with any transaction hash
• Commerce queries Mollie and marks the target transaction successful for the full amount
• Defenders must verify exposure and assess potential impact

Technical summary

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters (commerceTransactionHash and id) and never verifies that they belong together. An unauthenticated attacker holding any paid Mollie payment ID from the merchant's account can pair it with any transaction hash. Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction's full amount, regardless of how much was actually paid. This allows attackers to manipulate transaction statuses, potentially leading to financial losses.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact

Recommended defensive actions

• Verify exposure by checking Craft Commerce and Mollie payment integration configurations
• Assess potential impact by reviewing transaction hashes and payment IDs
• Implement compensating controls to monitor and validate transaction statuses
• Review vendor guidance and apply patches or updates
• Monitor for suspicious activity and adjust detection rules
• Perform regular security audits and vulnerability assessments
• Maintain up-to-date asset inventory and track changes

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, defenders need to verify exposure and assess potential impact by reviewing transaction hashes and payment IDs. The vulnerability allows unauthenticated attackers to pair any paid Mollie payment ID with any transaction hash, potentially leading to financial losses. Commerce queries Mollie and marks the target transaction successful for the full amount, regardless of how much was actually paid. Defenders must verify exposure and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.