What is Crédit Agricole Leasing & Factoring Dutch Branch's cybersecurity risk score?

Crédit Agricole Leasing & Factoring Dutch Branch has an AI-generated cybersecurity risk score of 751 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Crédit Agricole Leasing & Factoring Dutch Branch experienced?

According to Rankiteo, Crédit Agricole Leasing & Factoring Dutch Branch currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Crédit Agricole Leasing & Factoring Dutch Branch been affected by any supply chain cyber incidents ?

According to Rankiteo, Crédit Agricole Leasing & Factoring Dutch Branch has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does Crédit Agricole Leasing & Factoring Dutch Branch have SOC 2 Type 1 certification ?

According to Rankiteo, Crédit Agricole Leasing & Factoring Dutch Branch is not certified under SOC 2 Type 1.

Does Crédit Agricole Leasing & Factoring Dutch Branch have SOC 2 Type 2 certification ?

According to Rankiteo, Crédit Agricole Leasing & Factoring Dutch Branch does not hold a SOC 2 Type 2 certification.

Does Crédit Agricole Leasing & Factoring Dutch Branch comply with GDPR ?

According to Rankiteo, Crédit Agricole Leasing & Factoring Dutch Branch is not listed as GDPR compliant.

Does Crédit Agricole Leasing & Factoring Dutch Branch have PCI DSS certification ?

According to Rankiteo, Crédit Agricole Leasing & Factoring Dutch Branch does not currently maintain PCI DSS compliance.

Does Crédit Agricole Leasing & Factoring Dutch Branch comply with HIPAA ?

According to Rankiteo, Crédit Agricole Leasing & Factoring Dutch Branch is not compliant with HIPAA regulations.

Does Crédit Agricole Leasing & Factoring Dutch Branch have ISO 27001 certification ?

According to Rankiteo,Crédit Agricole Leasing & Factoring Dutch Branch is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Crédit Agricole Leasing & Factoring Dutch Branch operate in ?

Crédit Agricole Leasing & Factoring Dutch Branch operates primarily in the Financial Services industry.

How many employees does Crédit Agricole Leasing & Factoring Dutch Branch have ?

Crédit Agricole Leasing & Factoring Dutch Branch employs approximately 1 people worldwide.

Does Crédit Agricole Leasing & Factoring Dutch Branch own any subsidiaries ?

Crédit Agricole Leasing & Factoring Dutch Branch presently has no subsidiaries across any sectors.

How many LinkedIn followers does Crédit Agricole Leasing & Factoring Dutch Branch have ?

Crédit Agricole Leasing & Factoring Dutch Branch's official LinkedIn profile has approximately 342 followers.

What is the NAICS classification code for Crédit Agricole Leasing & Factoring Dutch Branch ?

Crédit Agricole Leasing & Factoring Dutch Branch is classified under the NAICS code 52, which corresponds to Finance and Insurance.

Does Crédit Agricole Leasing & Factoring Dutch Branch have a Crunchbase profile ?

No, Crédit Agricole Leasing & Factoring Dutch Branch does not have a profile on Crunchbase.

Does Crédit Agricole Leasing & Factoring Dutch Branch have a LinkedIn profile ?

Yes, Crédit Agricole Leasing & Factoring Dutch Branch maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/calf-dutch.

How many cybersecurity incidents has Crédit Agricole Leasing & Factoring Dutch Branch experienced ?

As of September 9, 2026, Rankiteo reports that Crédit Agricole Leasing & Factoring Dutch Branch has not experienced any cybersecurity incidents.

How many peer or competitor companies does Crédit Agricole Leasing & Factoring Dutch Branch have ?

Crédit Agricole Leasing & Factoring Dutch Branch has an estimated 32,723 peer or competitor companies worldwide.

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

CALFDB

Boost Score +25 with badge (5 left)

751

/1000

Fair

776

/1000

Fair

Crédit Agricole Leasing & Factoring Dutch Branch Vendor Cyber Rating & Cyber Score

eurofactor.nl

Add Your Compliance Badge

Crédit Agricole Leasing & Factoring S.A. - Dutch Branch* is the branch of the French public limited company CA Leasing & Factoring S.A. in Paris and offers factoring services for companies. As part of the Crédit Agricole Group (parent company), Crédit Agricole Leasing & Factoring is one of the leading European finance providers. *) In future the name Eurofactor GmbH will operate as a branch under the name Crédit Agricole Leasing & Factoring S.A. Germanny/Belgium and Dutch Branch. Crédit Agricole Leasing & Factoring S.A. - Dutch Branch Reitscheweg 1-7 9de verdieping 5232 BX's-Hertogenbosch Tel: +31 73 68 945 07 [email protected] Headquarter Crédit Agricole Leasing & Factoring S.A. Crédit Agricole Leasing & Factoring S.A. (CAL&F) Place

CALFDB

Crédit Agricole Leasing & Factoring Dutch Branch CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

No data available

Loading…

A.I.

CALFDB Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for CALFDB

Incidents vs Financial Services Industry Avg (This Year)

No incidents recorded for Crédit Agricole Leasing & Factoring Dutch Branch in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Crédit Agricole Leasing & Factoring Dutch Branch in 2026.

Incident Types CALFDB vs Financial Services Industry Avg (This Year)

No incidents recorded for Crédit Agricole Leasing & Factoring Dutch Branch in 2026.

Incident History - CALFDB (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Crédit Agricole Leasing & Factoring Dutch Branch Subsidiaries

Parent Company

CALFDB

Financial Services

Website: https://nl.eurofactor.nl/

Company Size: 51-200 employees

No subsidiary data available for this company.

Loading…

Crédit Agricole Leasing & Factoring Dutch Branch Similar Companies

Motilal Oswal Financial Services Ltd

motilaloswalgroup.com

Motilal Oswal Financial Services Ltd. (MOFSL) was founded in 1987 as a small sub-broking unit, with just 2 people running the show. Focus on a customer-first attitude, ethical and transparent business practices, respect for professionalism, research-based value investing, and implementation of cutting-edge technology has enabled us to blossom into a 12,000+ member team. Today we are a well-diversified financial services firm offering a range of financial products and services such as Private Wealth, Retail Broking and Distribution, Institutional Broking, Asset Management, Investment Banking, Private Equity, Commodity Broking, Currency Broking, and Home Finance. We have a diversified client base that includes retail customers (including High Net worth Individuals), mutual funds, foreign institutional investors, financial institutions, and corporate clients. We are headquartered in Mumbai and, as of September 2022, had a network spread over 550 cities and towns comprising 2500+ Business Locations operated by our Business Partners, us, and 5.2 Million+ customers. Research is the solid foundation on which MOFSL advice is based. Almost 10% of revenue is invested in equity research, and we hire and train the best resources to become our advisors. At present we have 25+ research analysts researching over 250 companies across 20 sectors. From a fundamental, technical, and derivatives research perspective, Motilal Oswal’s research reports have received wide coverage in the media. Our consistent efforts towards quality equity research have reflected in an increase in the ratings and rankings across various categories in the AsiaMoney Brokers Poll over the years. We have also been awarded the Best Performing Equity Broker (National) at the CNBC TV18 Financial Advisor Awards for five years in a row & got inducted into the ‘Hall of Fame’ at the 10th Financial Advisory Awards 2019.

Wells Fargo Advisors

wellsfargoadvisors.com

With financial advisors serving our clients in all 50 states, Wells Fargo Advisors is headquartered in St. Louis. At the end of the day, we help our clients succeed financially. For us – our Financial Advisors and thousands of other team members – it's a commitment. It's about honoring our relationship with clients and being fully invested in their success. Investors’ needs are more complex now than at any time in history. There are the usual concerns that investors can plan for, but there are also those events when life happens. That’s why investors are increasingly looking for advice they can trust from a financial services firm which has experience and expertise, and an uncompromising dedication to its clients. Opinions and comments expressed by LinkedIn Members are those of the persons submitting them and do not necessarily represent our views. Additional guidelines can be found on wfa.com/social. Investment and Insurance Products are: * Not Insured by the FDIC or Any Federal Government Agency * Not a Deposit or Other Obligation of, or Guaranteed by, the Bank or Any Bank Affiliate * Subject to Investment Risks, Including Possible Loss of the Principal Amount Invested Wells Fargo recognizes and values the diversity of its employees, customers and business partners. EOE, M/F/D/V. Wells Fargo Advisors is a trade name used by Wells Fargo Clearing Services, LLC and Wells Fargo Advisors Financial Network, LLC, Members SIPC, separate registered broker-dealers and non-bank affiliates of Wells Fargo & Company. © 2021 - 2025 Wells Fargo Clearing Services, LLC. All rights reserved. PM-09182026-6068127.2.1 Wells Fargo Investment Institute, Inc. (WFII) is a registered investment adviser and wholly-owned subsidiary of Wells Fargo Bank, N.A., a bank affiliate of Wells Fargo & Company.

American Express

americanexpress.com

At American Express, we know that with the right backing, people and businesses have the power to progress in incredible ways. Whether we’re supporting our customers’ financial confidence to move ahead, taking commerce to new heights, or encouraging people to explore the world, our colleagues are constantly striving to uphold our powerful backing promise to our customers and each other every day. These beliefs have been our North Star for 170 years as our business transformed – from helping evacuate travelers during World Wars, to ensuring the safety of our customers’ funds during the Great Depression in the U.S., to creating the Shop Small® movement to help small businesses recover from the Financial Crisis, to providing aid to communities impacted by many natural disasters and so much more. For generations, the key to our success has been the determination and resilience of our American Express colleagues. Now, as a globally integrated payments company, we work together to provide customers with access to products, insights and world-class experiences that enrich lives and build business success. Join us and let’s lead the way together. Learn more about us at: https://www.americanexpress.com/careers https://www.americanexpress.com/ https://www.facebook.com/AmericanExpressUS https://www.instagram.com/americanexpress/ https://twitter.com/americanexpress https://www.youtube.com/user/AmericanExpress See our community guidelines at: https://www.americanexpress.com/en-us/company/community-guidelines/ If you have a customer service issue or question, please visit www.americanexpress.com/contactus

DNB

dnb.no

We are here. So you can stay ahead. For nearly two hundred years we have acquired and shared knowledge, developed global networks and adapted to modern everyday life. To us, it is important to combine profitability with responsibility. DNB is Norway's largest financial services group and one of the largest in the Nordic region in terms of market capitalisation. The Group offers a full range of financial services, including loans, savings, advisory services, insurance and pension products for retail and corporate customers. DNB’s bank branches in Norway, in-store postal and banking outlets, Post office counters, Internet banking, mobile services and international offices ensure that we are present where our customers are. We are a major operator in a number of industries, for which we also have a Nordic or international strategy. DNB is one of the world’s leading shipping banks and has a strong position in the energy sector, and the fisheries and seafood industry. As an international financial institution we offer a wide range of services from our offices around the globe. At DNB you can find career opportunities in many fields, and with offices in 22 countries we are dependent on employees with different backgrounds and skills - all equally important for DNB's performance.

MassMutual

MassMutual.com

Living mutual has always been at the core of our human existence, and it's the principle that's guided us since our founding in 1851. It's not a concept we invented, but one we champion for the simple reason that people take it for granted today. While the world would have us strive for independence, the truth is when we depend on one another, we aren't just more secure - life is happier and more fulfilling. So as we celebrate our new identity, we're reminding everyone that who we are stays the same. Learn more at: www.MassMutual.com Disclosures about MassMutual’s LinkedIn Company Page and other social media sites are located at: https://www.massmutual.com/social-media-guidelines. CRN201905-212768

BDO Unibank

cb bdo.com.ph

BDO is a full-service universal bank in the Philippines. It provides a complete array of industry-leading products and services including Lending (corporate and consumer), Deposit-taking, Foreign Exchange, Brokering, Trust and Investments, Credit Cards, Corporate Cash Management, and Remittances in the Philippines. Through its local subsidiaries, the Bank offers Leasing and Financing, Investment Banking, Private Banking, Rural Banking, Life Insurance, Insurance Brokerage, and Stock Brokerage services. BDO's institutional strengths and value-added products and services hold the key to its successful business relationships with customers. Its branches remain at the forefront of setting high standards as a sales- and service-oriented, customer-focused force. BDO has one of the largest distribution networks, with more than 1,600 operating branches and over 4,500 ATMs nationwide. Through selective acquisitions and organic growth, BDO has positioned itself for increased balance sheet strength and continuing expansion into new markets. As of 30 June 2022, BDO is the country's largest bank in terms of total resources, customer loans, deposits, and assets under management. BDO is a publicly listed company (PLC), with its shares currently being traded at the Philippine Stock Exchange under the symbol “BDO”. BDO Unibank is regulated by the Banko Sentral ng Pilipinas. https://www.bsp.gov.ph For concerns, please visit any BDO branch near you or reach us through any of the channels listed in the Consumer Assistance page of our website: https://www.bdo.com.ph/consumer-assistance. Deposits are insured by PDIC up to P1 Million per depositor. The BDO, BDO Unibank and other BDO-related trademarks are owned by BDO Unibank, Inc. All Rights Reserved.

SBI Card

cb sbicard.com

SBI Card was launched in 1998 with the State Bank of India, India's largest bank, as the majority stakeholder. In March 2020, SBI Card was listed on BSE and NSE. Today, SBI Card is India’s largest pure-play credit card issuer with over 20 million cards in force, as of December 2024. Its wide array of products and services caters to a diverse range of customer segments across India, right from new-to-credit to super premium. The SBI Card brand is based on the value proposition of 'Make Life Simple'. The proposition manifests in SBI Card’s continuous efforts to simplify the lives of its customers, employees and other key stakeholders. Customer-centricity, supported by the values of trust and transparency, is core to SBI Card’s ethos.

Block

block.xyz

Block is one company built from many blocks, all united by the same purpose of economic empowerment. The blocks that form our foundational teams — People, Finance, Counsel, Hardware, Information Security, Platform Infrastructure Engineering, and more — provide support and guidance at the corporate level. They work across business groups and around the globe, spanning time zones and disciplines to develop inclusive People policies, forecast finances, give legal counsel, safeguard systems, nurture new initiatives, and more. Every challenge creates possibilities, and we need different perspectives to see them all. Bring yours to Block.

Fidelity Investments

fidelity.com

Fidelity’s mission is to strengthen the financial well-being of our customers and deliver better outcomes for the clients and businesses we serve. Fidelity’s strength comes from the scale of our diversified, market-leading financial services businesses that serve individuals, families, employers, wealth management firms, and institutions. With assets under administration of $15.0 trillion, including discretionary assets of $5.9 trillion as of March 31, 2025, we focus on meeting the unique needs of a broad and growing customer base. Privately held for 78 years, Fidelity employs more than 77,000 associates across the United States, Ireland, and India. For our Terms and Conditions, please visit http://go.fidelity.com/LIterms

Loading…

NEWS

Crédit Agricole Leasing & Factoring Dutch Branch CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

December 22, 2025 09:20 AM

Top Players and Competitive Dynamics in the Financial Leasing Services Market

Press release - The Business Research Company - Top Players and Competitive Dynamics in the Financial Leasing Services Market - published on...

Read Article

December 04, 2025 08:00 AM

Fitch Affirms Credit Agricole at 'A+'; Stable Outlook

Fitch Ratings-Paris-04 December 2025:Fitch Ratings has affirmed Credit Agricole's (CA) Long-Term Issuer Default Rating (IDR) at 'A+' and...

Read Article

August 01, 2025 07:00 AM

Credit Agricole Group financial results for the second quarter and first half of 2025

The Group published high-level revenues and income demonstrating growth. Quarterly revenues reached record levels of €9.8 billion for Crédit...

Read Article

June 27, 2025 07:00 AM

Biogas, ESG and Livestock Farming: What Crédit Agricole Bank Is Investing In For 2025

Crédit Agricole is launching loans for small farmers, investing in biogas and solar energy, and changing its approach to ESG in Ukraine.

Read Article

May 15, 2025 07:00 AM

Credit Agricole Sa: Crédit Agricole Leasing & Factoring completes acquisition of German group Merca Leasing

Crédit Agricole Leasing & Factoring (CAL&F) announces that it has obtained all the necessary authorizations and today finalized the acquisition...

Read Article

April 25, 2025 07:00 AM

Eight WFW deals win at Marine Money Deal of the Year Awards

WFW is delighted to announce that Marine Money has named eight deals the firm advised on 'Deals of the Year'.

Read Article

February 18, 2025 08:00 AM

K&L Gates Advises Financier Crédit Agricole CIB in Providing Southeast Asia's First Ever Sustainability-Linked Loan for a Low-Cost Carrier

K&L Gates has advised leading international bank Crédit Agricole CIB in providing Southeast Asia's first-ever sustainability-linked loan (SLL) to a low-cost...

Read Article

February 05, 2025 08:00 AM

Asia-Pacific ESG Financing House: Credit Agricole CIB

The sky's the limit Credit Agricole used sustainability-linked financings for Chinese leasing companies to help cut the transport sector's...

Read Article

December 13, 2024 08:00 AM

Crédit Agricole named best bank in France 2024

At a ceremony in London, The Banker, part of the Financial Times group, revealed the winners of its Bank of the Year Awards 2024.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-86564

SUMMARY

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 3.3)

cvss3

Base Score: 3.3

Complexity: LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Impact Score

1.4

Exploitability

1.8

REFERENCES

CVE-2026-55250

SUMMARY

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected. This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support. If found, it forcefully wraps 14-day token blacklist entries (jti) inside a relational tymon.jwt tag. In environments where the O(1) Atomic Lazy Eviction model is active — either natively inside Maravel-Framework v20.x or manually backported into v10.x via the explicit DI container singletons provided in PR #104 (App\Cache\TaggedCache and App\Cache\TagSet) — a strict global tracking ceiling (Container::TAGGED_CACHE_TTL_CAP_SECONDS) of 7,200 seconds (2 hours) is enforced to secure the system against memory index bloat. This ceiling forcefully truncates the 14-day blacklist lifespan down to a maximum of 2 hours, after which individual tracking keys naturally expire and disappear from the active cache window. Furthermore, because the optimized engine implements a generational version matrix to achieve O(1) flush speeds, any programmatic or manual invocation of a tag flush or reset (e.g., Cache::tags([...])->flush()) instantly bumps the internal atomic master version pointer. This shifts the computed cryptographic composite hash (sha1($this->tags->getNamespace())) for all overlapping components, rendering the entire existing index immediately unreachable. Consequently, through either natural 2-hour expiration or an intervening tag flush execution (like the cache naturally cleaning old values to free up memory), the invalidation state records are entirely wiped out. Because the tokens' physical cryptographic signatures remain structurally valid for up to 14 days, stolen, hijacked, or legitimately logged-out tokens are instantly and silently resurrected across the entire API gateway, leaving the application critically vulnerable to widespread Token Replay Attacks. Because this issue is caused by an upstream architectural assumption within the tymon/jwt-auth package rather than a core defect inside the framework, there is no direct framework version upgrade that can safely bypass this lifecycle collision without breaking business cache recycling bounds. Maravel version 10.74.0 introduced a way to backport the new fixed tagged cache from 20.x into 10.x by resolving TagSet and TaggedCache from DI, which is how this latent architectural lifecycle vulnerability was discovered. Users must apply the decoupled configuration workaround outlined below. As a workaround, make sure that cache memory size does not generate early natural evictions from cache to free up space, deleting blacklisted jwt ids before they expire. Applications must decouple flat authentication vectors from the relational tagging subsystem. This forces token identifiers to write directly to the primary cache keyspace as flat, un-tagged key-value pairs where they securely retain their unclipped 14-day lifecycle.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 8.7

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-53639

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e.g. `target_path`, `after_path`). These fields are used by the front-end controller to redirect the user after the payment, so an attacker can flip them to an attacker-controlled URL and intercept the buyer. The hash is a UUID, so it has to be obtained out-of-band (logs, shared links, referrer headers, a co-located client), but once it is known no other credential is required, neither authentication nor knowledge of the order token. The creation endpoint `POST /api/v2/shop/orders/{tokenValue}/payment-requests` shares the same flaw: it resolves the target order solely from the `tokenValue` in the URL without verifying that the caller owns the order. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6. As a workaround, add a query extension that filters the `GET` operation; decorate the `PUT` state provider, guard the `POST` creation endpoint with a command-bus middleware, and wire the services.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 6.3

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-mr9r-h354-966r

CVE-2026-53638

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 4.3)

cvss3

Base Score: 4.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Impact Score

1.4

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-6955-hrm5-c4qp

CVE-2026-53637

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 6.5)

cvss3

Base Score: 6.5

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impact Score

3.6

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…

Badge your company to reduce your risk score and your cyber insurance costs!

Trusted by insurers. Chosen by leaders.

Crédit Agricole Leasing & Factoring Dutch Branch Vendor Cyber Rating & Cyber Score

CALFDB A.I CyberSecurity Scoring

Crédit Agricole Leasing & Factoring Dutch Branch CyberSecurity News & History

CALFDB Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for CALFDB

Incidents vs Financial Services Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types CALFDB vs Financial Services Industry Avg (This Year)

Incident History - CALFDB (X = Date, Y = Severity)

Crédit Agricole Leasing & Factoring Dutch Branch Subsidiaries

Parent Company

CALFDB

Crédit Agricole Leasing & Factoring Dutch Branch Similar Companies

Motilal Oswal Financial Services Ltd

Wells Fargo Advisors

American Express

DNB

MassMutual

BDO Unibank

SBI Card

Block

Fidelity Investments

Crédit Agricole Leasing & Factoring Dutch Branch CyberSecurity News

Top Players and Competitive Dynamics in the Financial Leasing Services Market

Fitch Affirms Credit Agricole at 'A+'; Stable Outlook

Credit Agricole Group financial results for the second quarter and first half of 2025

Biogas, ESG and Livestock Farming: What Crédit Agricole Bank Is Investing In For 2025

Credit Agricole Sa: Crédit Agricole Leasing & Factoring completes acquisition of German group Merca Leasing

Eight WFW deals win at Marine Money Deal of the Year Awards

K&L Gates Advises Financier Crédit Agricole CIB in Providing Southeast Asia's First Ever Sustainability-Linked Loan for a Low-Cost Carrier

Asia-Pacific ESG Financing House: Credit Agricole CIB

Crédit Agricole named best bank in France 2024

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo

Crédit Agricole Leasing & Factoring Dutch Branch CyberSecurity News & History

CALFDB Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for CALFDB

Incidents vs Financial Services Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types CALFDB vs Financial Services Industry Avg (This Year)

Incident History - CALFDB (X = Date, Y = Severity)

Crédit Agricole Leasing & Factoring Dutch Branch Subsidiaries

Parent Company

CALFDB

Crédit Agricole Leasing & Factoring Dutch Branch Similar Companies

Motilal Oswal Financial Services Ltd

Wells Fargo Advisors

American Express

DNB

MassMutual

BDO Unibank

SBI Card

Block

Fidelity Investments

Crédit Agricole Leasing & Factoring Dutch Branch CyberSecurity News

Top Players and Competitive Dynamics in the Financial Leasing Services Market

Fitch Affirms Credit Agricole at 'A+'; Stable Outlook

Credit Agricole Group financial results for the second quarter and first half of 2025

Biogas, ESG and Livestock Farming: What Crédit Agricole Bank Is Investing In For 2025

Credit Agricole Sa: Crédit Agricole Leasing & Factoring completes acquisition of German group Merca Leasing

Eight WFW deals win at Marine Money Deal of the Year Awards

K&L Gates Advises Financier Crédit Agricole CIB in Providing Southeast Asia's First Ever Sustainability-Linked Loan for a Low-Cost Carrier

Asia-Pacific ESG Financing House: Credit Agricole CIB

Crédit Agricole named best bank in France 2024

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?