{"items":[{"id":"NVI-00005164","kind":"vulnerability","title":"Ability to switch customer email address on account detail page and stay verified","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-6gw4-x63h-5499","CVE-2020-15245"],"plain_summary":"OSV carries this publisher advisory for sylius/sylius, sylius/sylius, sylius/sylius. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.7.9 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.8.3 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.6.9 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-36f9ccbf0df9d42df4d219bf1cf2abcb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4 MEDIUM (2.0)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"},{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4.3 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"},{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.627%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.50074. Missing scores are unknown.","source_id":"sr-36f9ccbf0df9d42df4d219bf1cf2abcb"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8500c2bb401847ece5f3a13da20a9ecc","url":"https://github.com/advisories/GHSA-6gw4-x63h-5499","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6gw4-x63h-5499","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.936Z"},{"id":"sr-97cfb30a04c179f4c83f24778210ae6b","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15245","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2020-15245","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T22:07:06.394Z"},{"id":"sr-36f9ccbf0df9d42df4d219bf1cf2abcb","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2020-15245","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:27:48.610Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.7.0; fixed 1.7.9"]},{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.8.0; fixed 1.8.3"]},{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.0.0; fixed 1.6.9"]}],"null_published_at":"2026-11-07T18:43:15.100Z","source_updated_at":"2026-09-10T03:48:59.036Z","source_disclosed_at":"2020-10-19T20:40:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:59.936Z"},{"id":"NVI-00005164","kind":"vulnerability","title":"Ability to switch customer email address on account detail page and stay verified","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-6gw4-x63h-5499","CVE-2020-15245"],"plain_summary":"OSV carries this publisher advisory for sylius/sylius, sylius/sylius, sylius/sylius. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.7.9 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.8.3 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.6.9 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4e62350d7e60de2762bf9ff9125f5454"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4 MEDIUM (2.0)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"},{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4.3 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"},{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.627%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.50077. Missing scores are unknown.","source_id":"sr-4e62350d7e60de2762bf9ff9125f5454"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8500c2bb401847ece5f3a13da20a9ecc","url":"https://github.com/advisories/GHSA-6gw4-x63h-5499","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6gw4-x63h-5499","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.936Z"},{"id":"sr-97cfb30a04c179f4c83f24778210ae6b","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15245","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2020-15245","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T22:07:06.394Z"},{"id":"sr-4e62350d7e60de2762bf9ff9125f5454","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2020-15245","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:03.704Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.7.0; fixed 1.7.9"]},{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.8.0; fixed 1.8.3"]},{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.0.0; fixed 1.6.9"]}],"null_published_at":"2026-10-31T23:18:17.283Z","source_updated_at":"2026-09-10T03:48:59.036Z","source_disclosed_at":"2020-10-19T20:40:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:59.936Z"},{"id":"NVI-00005164","kind":"vulnerability","title":"Ability to switch customer email address on account detail page and stay verified","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-6gw4-x63h-5499","CVE-2020-15245"],"plain_summary":"OSV carries this publisher advisory for sylius/sylius, sylius/sylius, sylius/sylius. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.7.9 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.8.3 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.6.9 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-97cfb30a04c179f4c83f24778210ae6b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4 MEDIUM (2.0)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"},{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4.3 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"},{"kind":"CVSS","as_of":"2026-06-17T02:56:20.950Z","value":"4.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-97cfb30a04c179f4c83f24778210ae6b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8500c2bb401847ece5f3a13da20a9ecc","url":"https://github.com/advisories/GHSA-6gw4-x63h-5499","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6gw4-x63h-5499","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.936Z"},{"id":"sr-97cfb30a04c179f4c83f24778210ae6b","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15245","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2020-15245","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T22:07:06.394Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.7.0; fixed 1.7.9"]},{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.8.0; fixed 1.8.3"]},{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.0.0; fixed 1.6.9"]}],"null_published_at":"2026-10-31T22:27:12.387Z","source_updated_at":"2026-09-10T03:48:59.036Z","source_disclosed_at":"2020-10-19T20:40:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:59.936Z"},{"id":"NVI-00005164","kind":"vulnerability","title":"Ability to switch customer email address on account detail page and stay verified","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6gw4-x63h-5499","CVE-2020-15245"],"plain_summary":"OSV carries this publisher advisory for sylius/sylius, sylius/sylius, sylius/sylius. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.7.9 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.8.3 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.6.9 for sylius/sylius. Confirm the publisher’s latest guidance.","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8500c2bb401847ece5f3a13da20a9ecc","url":"https://github.com/advisories/GHSA-6gw4-x63h-5499","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6gw4-x63h-5499","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.936Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.7.0; fixed 1.7.9"]},{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.8.0; fixed 1.8.3"]},{"certainty":"source_listed","source_ids":["sr-8500c2bb401847ece5f3a13da20a9ecc"],"technology":"sylius/sylius","known_exclusions":[],"conditions_summary":"### Impact\nThe user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).\n\n### Patches\nPatch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.\n\n### Workarounds\nIf for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event h","public_affected_ranges":["ECOSYSTEM: introduced 1.0.0; fixed 1.6.9"]}],"null_published_at":"2026-10-31T22:13:01.452Z","source_updated_at":"2026-09-10T03:48:59.036Z","source_disclosed_at":"2020-10-19T20:40:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:59.936Z"}],"next_cursor":null,"snapshot_revision":"42594"}