What is the official website of T-Systems Romania ?

The official website of T-Systems Romania is https://www.t-systems.com/de/en.

What is T-Systems Romania's cybersecurity risk score?

T-Systems Romania has an AI-generated cybersecurity risk score of 749 out of 1000, indicating a Moderate security posture according to Rankiteo's assessment.

How many security incidents has T-Systems Romania experienced?

According to Rankiteo, T-Systems Romania currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has T-Systems Romania been affected by any supply chain cyber incidents ?

According to Rankiteo, T-Systems Romania has been affected by a supply chain cyber incident involving Lovable, with the incident ID LOV1776717678.

Does T-Systems Romania have SOC 2 Type 1 certification ?

According to Rankiteo, T-Systems Romania is not certified under SOC 2 Type 1.

Does T-Systems Romania have SOC 2 Type 2 certification ?

According to Rankiteo, T-Systems Romania does not hold a SOC 2 Type 2 certification.

Does T-Systems Romania comply with GDPR ?

According to Rankiteo, T-Systems Romania is not listed as GDPR compliant.

Does T-Systems Romania have PCI DSS certification ?

According to Rankiteo, T-Systems Romania does not currently maintain PCI DSS compliance.

Does T-Systems Romania comply with HIPAA ?

According to Rankiteo, T-Systems Romania is not compliant with HIPAA regulations.

Does T-Systems Romania have ISO 27001 certification ?

According to Rankiteo,T-Systems Romania is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does T-Systems Romania operate in ?

T-Systems Romania operates primarily in the IT Services and IT Consulting industry.

How many employees does T-Systems Romania have ?

T-Systems Romania employs approximately 25 people worldwide.

Does T-Systems Romania own any subsidiaries ?

T-Systems Romania presently has no subsidiaries across any sectors.

How many LinkedIn followers does T-Systems Romania have ?

T-Systems Romania's official LinkedIn profile has approximately 5,233 followers.

What is the NAICS classification code for T-Systems Romania ?

T-Systems Romania is classified under the NAICS code 5415, which corresponds to Computer Systems Design and Related Services.

Does T-Systems Romania have a Crunchbase profile ?

No, T-Systems Romania does not have a profile on Crunchbase.

Does T-Systems Romania have a LinkedIn profile ?

Yes, T-Systems Romania maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/t-systems-romania.

How many cybersecurity incidents has T-Systems Romania experienced ?

As of September 9, 2026, Rankiteo reports that T-Systems Romania has experienced 1 cybersecurity incidents.

How many peer or competitor companies does T-Systems Romania have ?

T-Systems Romania has an estimated 41,567 peer or competitor companies worldwide.

What types of cybersecurity incidents has T-Systems Romania faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

T-Systems Romania

Boost Score +25 with badge (5 left)

749

/1000

Moderate

774

/1000

Fair

T-Systems Romania Vendor Cyber Rating & Cyber Score

t-systems.com

Add Your Compliance Badge

T-systems is one of the leading providers of digital services, offering integrated end-to-end IT solutions and digital transformation of companies in all industries (automotive, financial services, healthcare, public sector, retail, manufacturing industry, transport, and logistics). We are your partner for digitalization.

T-Systems Romania

T-Systems Romania CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Deutsche Telekom

Breach

4/2026

Lovable

LOV1776717678

Loading…

A.I.

T-Systems Romania Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for T-Systems Romania

Incidents vs IT Services and IT Consulting Industry Avg (This Year)

No incidents recorded for T-Systems Romania in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for T-Systems Romania in 2026.

Incident Types T-Systems Romania vs IT Services and IT Consulting Industry Avg (This Year)

No incidents recorded for T-Systems Romania in 2026.

Incident History - T-Systems Romania (X = Date, Y = Severity)

Loading…

SUBSIDIARY

T-Systems Romania Subsidiaries

T-Systems Romania

IT Services and IT Consulting

Website: https://www.t-systems.com/de/en

Company Size: 25

Deutsche TelekomTelecommunications

T-Systems do BrasilIT Services and IT Consulting

T-Security ConnectAtividades de monitoramento de sistemas de segurança

T-Systems InternationalIT Services and IT Consulting

T-Systems MéxicoIT Services and IT Consulting

T-Systems Nederland B.V.IT Services and IT Consulting

T-Systems CloudIT-Dienstleistungen und IT-Beratung

Deutsche Telekom Digital LabsTelecommunications

T-Systems IberiaIT Services and IT Consulting

Agile Hub T-Systems IberiaServicios y consultoría de TI

DigiCloudServicios y consultoría de TI

GIMM SolutionsIT Services and IT Consulting

J-EDI Digital SolutionsInformation Technology & Services

Telekom HUTelecommunications

Hrvatski TelekomTelecommunications

Deutsche Telekom IoTIT Services and IT Consulting

T BusinessTelekommunikation

T-Systems ICT India Pvt. Ltd.IT Services and IT Consulting

T-Systems SingaporeIT Services and IT Consulting

Deutsche Telekom Services Europe Romania (DTSE Romania)Outsourcing and Offshoring Consulting

T-Mobile PolskaTelecommunications

T-Mobile Czech RepublicTelekomunikace

DeteconBusiness Consulting and Services

Makedonski Telekom ADTelecommunications

Telekom MMSIT Services and IT Consulting

T-Systems MMSIT Services and IT Consulting

Deutsche Telekom Cloud ServicesTelecommunications

Deutsche Telekom IT Solutions SlovakiaIT Services and IT Consulting

T-Systems Hungary Ltd.IT Services and IT Consulting

T-Mobile Biznes PolskaTelecommunications

Deutsche Telekom Global CarrierTelekommunikation

Deutsche Telekom Global BusinessTelecommunications

Telekom Strategy ConsultingTelekommunikation

congstarTelecommunications

T-Systems UKIT Services and IT Consulting

Cyber Security at T-SystemsIT Services and IT Consulting

T-Systems VamosaIT Services and IT Consulting

T-Systems SwitzerlandIT Services and IT Consulting

T-Systems FranceIT Services and IT Consulting

Deutsche Telekom Services Europe - SlovakiaOutsourcing and Offshoring Consulting

T-Systems AustriaInformation Technology & Services

Digitales GesundheitswesenWellness und Fitness

Deutsche Telekom Services Europe - Czech RepublicOutsourcing and Offshoring Consulting

Deutsche Telekom StiftungNon-profit Organizations

T-Systems NordicIT Services and IT Consulting

MagentaZuhauseTelekommunikation

T-Mobile Czech Republic a.s.Telecommunications

T-Mobile Polska Business Solutions IT Services and IT Consulting

Deutsche Telekom HealthcareHospitals and Health Care

LIFECARE Laboratorium InformatiesysteemZiekenhuizen en gezondheidszorg

Inflight Services of Deutsche TelekomTelekommunikation

Deutsche Telekom Design & Customer ExperienceTelecommunications

Deutsche Telekom UK LimitedTelecommunications

Deutsche Telekom - Digital, Experience & DeliveryTelecommunications

Telekom Open SpacesTelekommunikation

Deutsche Telekom Investor RelationsTelekommunikation

T SportTelecommunications

Deutsche Telekom EU PolicyTelecommunications

Deutsche Telekom Clinical Solutions India Pvt. Ltd.IT Services and IT Consulting

Deutsche Telekom Global Business Solutions FranceInformation Technology & Services

DeTeAssekuranz Vermittlungsgesellschaft mbHInsurance

Telekom TechBoostTelekommunikation

Slovak TelekomTelecommunications

Telekom Business EuropeTelecommunications

Loading…

T-Systems Romania Similar Companies

Engineering Group

eng.it

Engineering Group is the Digital Transformation Company, leader in Italy and expanding its global footprint, with around 14,000 associates and with over 80 offices spread across Europe, the United States, and South America and global delivery. The Engineering Group, consisting of over 70 companies in 21 countries, has been supporting the continuous evolution of companies and organizations for more than 40 years, thanks to a deep understanding of business processes in all market segments, fully leveraging the opportunities offered by advanced digital technologies and proprietary solutions. It integrates best-of-breed market solutions, managed services, and continues to expand its expertise through M&As and partnerships with leading technology players. The Group strongly invests both in innovation, through its R&I division, and in human capital, with the internal IT & Management Academy. Engineering is a key player in the creation of digital ecosystems that bridge the gap between different markets, while developing composable solutions that ultimately foster a continuous Business transformation. In 2026, Engineering achieved, for the second consecutive year, the Top Employers Italy certification, reaffirming the significant growth process for the company, which is constantly committed to enhancing HR policies to create a work environment centered on the well-being of people.

Swisscom

swisscom.ch

As No. 1, we inspire people in the connected world. With the latest technologies and innovations, together we have the opportunity to shape the future. To do this, we are and act trustworthy, committed and curious. Are you with us? Join us on this exciting journey and work with us or in one of the DevOps Centres in Riga or Rotterdam in different business areas on the latest technological trends. Find out more about us and our vacancies on our careers page: www.swisscom.ch/career We look forward to hearing from you!

Sutherland

sutherlandglobal.com

Artificial Intelligence. Automation. Cloud Engineering. Advanced Analytics. For Enterprises, these are key factors of success. For us, they’re our core expertise. We work with global iconic brands. We bring them a unique value proposition through market-leading technologies and business process excellence. At the heart of it all is Digital Engineering services – the foundation that powers rapid innovation and scalable business transformation. We’ve created 363 unique and independent inventions, 250 of which are AI-based and rolled up under several patent grants in critical technologies. Leveraging our advanced products and platforms, we drive digital transformation at scale, optimize critical business operations, reinvent experiences, and pioneer new solutions, all provided through a seamless “as-a-service” model. For each company, we provide new keys for their businesses, the people they work with, and the customers they serve. With proven strategies and agile execution, we don’t just enable change — we engineer digital outcomes.

AeC

aec.com.br

A AeC é apontada consistentemente como a líder brasileira na entrega de soluções de experiência do cliente e gestão de processos terceirizados. Servindo as principais marcas do mercado nacional, conquistou nos três últimos anos a posição de Empresa do Ano de BPO pela conceituada Frost and Sullivan. Líder também nas práticas de ESG, recebe há oito anos consecutivos o título de Melhor Empresa de Serviços pelo Prêmio Época Negócios 360°. Com um olhar inovador, o seu diferencial está no modo como integra o cuidado com as pessoas e aplica tecnologia de ponta em seus processos, como inteligência artificial, robotic process automation, serviços em nuvem e ferramentas de analytics e segurança. Atualmente, a AeC conta com mais de 52 mil colaboradores em 20 unidades distribuídas por sete estados do país. É certificada pelo instituto Great Place to Work como uma das melhores empresas para se trabalhar. Com uma combinação única de Tecnologia e Calor Humano, a mais de 30 anos de história conquistando, apenas no último ano, 27 importantes prêmios e reconhecimentos do mercado. Venha evoluir conosco! Entre em contato com a gente através do e-mail: [email protected]

IGT Solutions

igtsolutions.com

IGT Solutions is a next-gen customer experience (CX) company, defining and delivering AI-led transformative experiences for the global and most innovative brands using digital technologies. With the combination of Digital and Human Intelligence, IGT becomes the preferred partner for managing end-to-end CX journeys across Travel and High Growth Tech industries. Established in 1998, with a 100% focus on customer experience, IGT employs more than 25,000 customer experience and technology specialists providing services to 85 marquee customers globally. IGT’s global footprint consists of 31 delivery centers in China, Colombia, Egypt, India, Indonesia, Malaysia, Philippines, Romania, South Africa, Spain, UAE, the US, and Vietnam. IGT is ISO 27001:2013, CMMI SVC Level 5 and ISAE-3402 compliant for IT, and COPC® Certified v6.0, ISO 27001:2013 and PCI DSS 3.2 certified for BPO processes. The organization follows Six Sigma rigor for process improvements.

Apex Systems

apexsystems.com

Apex Systems is a leading global technology services firm that incorporates industry insights and experience to deliver solutions that fulfill our clients’ digital visions. We offer a continuum of services, specializing in strategy, transformation, and managed services across application development, data, enterprise platforms, cloud and infrastructure, and cybersecurity. Through our ability to innovate alongside our customers, we build and deploy the right artificial intelligence solutions to realize business value and improve customer experiences. Our alliances with cutting-edge technology partners empower our customers by providing them with the latest advancements. Apex has a presence in over 70 markets across North America, Europe, and India. Apex is a part of the commercial segment of ASGN Incorporated (NYSE: ASGN). To learn more, visit www.apexsystems.com. Apex strives to provide our talent with the best possible experience, from start to finish. Our commitment to excellence is reflected in many awards, including ClearlyRated's Best of Staffing® in Talent Satisfaction in the United States and Great Place to Work® in the United Kingdom and Mexico. Visit us today to join our team: www.apexsystems.com/careers.

SoftwareOne

softwareone.com

SoftwareOne is a global software and cloud solutions provider. With a presence in over 70 countries and a team of around 13,000 professionals, we combine global scale and local expertise to help clients optimize costs, accelerate growth, and navigate complex IT environments with confidence. Leveraging deep capabilities in cloud, software, and data and AI, the company empowers organizations to modernize, innovate, and unlock the full value of their technology investments. Headquartered in Switzerland, SoftwareOne is listed on the SIX Swiss Exchange and Euronext Oslo Børs under the ticker symbol SWON. Visit us: https://www.softwareone.com/en

Lenovo

lenovo.com

Lenovo is a US$83 billion revenue global technology powerhouse, ranked #196 in the Fortune Global 500, and serving millions of customers every day in 180 markets. Guided by its vision of “Smarter Technology for All”, Lenovo is executing a Hybrid AI strategy that spans Personal AI – one personal AI, multiple devices; and Enterprise AI – helping customers turn data into insights and value. This strategy is delivered through the Group’s commitment to world-class innovation and a full-stack AI portfolio, including devices (PCs, workstations, smartphones, tablets, accessories), infrastructure solutions (server, storage, edge, high performance computing and software defined infrastructure), as well as software, solutions, and services. With a global footprint spanning 21 research and development locations in 11 markets, and a global supply chain including more than 30 manufacturing sites across 10 markets, Lenovo is widely recognized for its operational excellence, including ranking #8 in the Gartner Supply Chain Top 25. Lenovo is listed on the Hong Kong stock exchange under Lenovo Group Limited (HKSE: 992) (ADR: LNVGY). To find out more visit https://www.lenovo.com, and read about the latest news via our StoryHub at https://news.lenovo.com/. To learn more about our career opportunities, visit our careers page at http://jobs.lenovo.com/.

Hexaware Technologies

hexaware.com

At Hexaware, we're not just a global technology and business process services company; we're a community of 31,600+ Hexawarians dedicated to one singular purpose: creating smiles through the power of great people and technology. With a presence in 58 offices across 28 countries, we empower enterprises worldwide to embark on their digital transformation journey with unparalleled scale and speed. As an employer, we're more than just a workplace. We put our people first, foster diversity and inclusivity, and prioritize their growth through robust learning and development programs. Our culture is a canvas for innovation as we work toward our shared vision of becoming the world’s most loved digital transformation partner. Exciting, isn’t it? Visit www.hexaware.com to join us in embracing the magic of technology, as we passionately advocate for its potential to transform lives today and shape a brighter future. Together, we'll make the digital world a better place.

Loading…

NEWS

T-Systems Romania CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

November 03, 2025 11:52 AM

Prioritizing Cybersecurity in the Digital Age: Over 350 specialists gathered in Cluj-Napoca, at the Cybersecurity in Energy Forum, organized by DEER in partnership with the Ministry of Energy

The third edition of the Energy Cybersecurity Forum, organized by Distribuție Energie Electrică Romania (DEER) in strategic partnership with...

Read Article

October 31, 2025 03:32 PM

Security concerns over system at heart of digital ID

The government is facing questions over whether One Login can be trusted to keep people's personal data secure.

Read Article

October 31, 2025 10:00 AM

Mircea Abrudean, President of the Senate: “Cybersecurity is a fundamental condition for the safe operation of energy systems”

“If we refer to energy security and cybersecurity, these two concepts can no longer be viewed separately, because we live in an era in which...

Read Article

October 16, 2025 07:00 AM

SCUT brings a unified vision on digital protection - a cybersecurity architecture that eliminates fragmentation between systems

SCUT, Romania's newest cybersecurity company, has officially launched the concept of the digital cyber shield — a unified approach,...

Read Article

October 14, 2025 07:00 AM

Revealed: Hundreds of passwords linked to government departments leaked on dark web

Exclusive: Nine attempts have been made to sell classified UK military documents in the past year – with experts warning it could 'directly...

Read Article

October 09, 2025 07:00 AM

Cybersecurity is no longer just a technical challenge – it's a leadership one

The widespread scale of cybercrime now makes it a strategic imperative for business leaders. But they can't simply focus on systems...

Read Article

September 23, 2025 07:00 AM

ABB’s new gas chromatograph integrates cybersecurity to protect industrial systems

The GCP100 is the first gas chromatograph with built-in cybersecurity on the market; It sets a new standard in cybersecurity and real-time...

Read Article

September 20, 2025 07:00 AM

Russia suspected of cyber attack on Heathrow and European airports

Travel disruption could last for days after a 'technical issue' hit boarding systems used by major airlines.

Read Article

September 15, 2025 07:00 AM

Romanian consortium led by certSIGN to support the European Union Agency for Cybersecurity in strengthening cybersecurity in Romania under NIS2 Directive

certSIGN, a Romania-based company and leading developer and integrator of cybersecurity and cryptographic solutions, has been awarded,...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-86564

SUMMARY

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 3.3)

cvss3

Base Score: 3.3

Complexity: LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Impact Score

1.4

Exploitability

1.8

REFERENCES

CVE-2026-55250

SUMMARY

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected. This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support. If found, it forcefully wraps 14-day token blacklist entries (jti) inside a relational tymon.jwt tag. In environments where the O(1) Atomic Lazy Eviction model is active — either natively inside Maravel-Framework v20.x or manually backported into v10.x via the explicit DI container singletons provided in PR #104 (App\Cache\TaggedCache and App\Cache\TagSet) — a strict global tracking ceiling (Container::TAGGED_CACHE_TTL_CAP_SECONDS) of 7,200 seconds (2 hours) is enforced to secure the system against memory index bloat. This ceiling forcefully truncates the 14-day blacklist lifespan down to a maximum of 2 hours, after which individual tracking keys naturally expire and disappear from the active cache window. Furthermore, because the optimized engine implements a generational version matrix to achieve O(1) flush speeds, any programmatic or manual invocation of a tag flush or reset (e.g., Cache::tags([...])->flush()) instantly bumps the internal atomic master version pointer. This shifts the computed cryptographic composite hash (sha1($this->tags->getNamespace())) for all overlapping components, rendering the entire existing index immediately unreachable. Consequently, through either natural 2-hour expiration or an intervening tag flush execution (like the cache naturally cleaning old values to free up memory), the invalidation state records are entirely wiped out. Because the tokens' physical cryptographic signatures remain structurally valid for up to 14 days, stolen, hijacked, or legitimately logged-out tokens are instantly and silently resurrected across the entire API gateway, leaving the application critically vulnerable to widespread Token Replay Attacks. Because this issue is caused by an upstream architectural assumption within the tymon/jwt-auth package rather than a core defect inside the framework, there is no direct framework version upgrade that can safely bypass this lifecycle collision without breaking business cache recycling bounds. Maravel version 10.74.0 introduced a way to backport the new fixed tagged cache from 20.x into 10.x by resolving TagSet and TaggedCache from DI, which is how this latent architectural lifecycle vulnerability was discovered. Users must apply the decoupled configuration workaround outlined below. As a workaround, make sure that cache memory size does not generate early natural evictions from cache to free up space, deleting blacklisted jwt ids before they expire. Applications must decouple flat authentication vectors from the relational tagging subsystem. This forces token identifiers to write directly to the primary cache keyspace as flat, un-tagged key-value pairs where they securely retain their unclipped 14-day lifecycle.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 8.7

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-53639

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e.g. `target_path`, `after_path`). These fields are used by the front-end controller to redirect the user after the payment, so an attacker can flip them to an attacker-controlled URL and intercept the buyer. The hash is a UUID, so it has to be obtained out-of-band (logs, shared links, referrer headers, a co-located client), but once it is known no other credential is required, neither authentication nor knowledge of the order token. The creation endpoint `POST /api/v2/shop/orders/{tokenValue}/payment-requests` shares the same flaw: it resolves the target order solely from the `tokenValue` in the URL without verifying that the caller owns the order. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6. As a workaround, add a query extension that filters the `GET` operation; decorate the `PUT` state provider, guard the `POST` creation endpoint with a command-bus middleware, and wire the services.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: )

cvss4

Base Score: 6.3

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-mr9r-h354-966r

CVE-2026-53638

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 4.3)

cvss3

Base Score: 4.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Impact Score

1.4

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-6955-hrm5-c4qp

CVE-2026-53637

SUMMARY

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

Published

Date2026-09-08

Updated

Date2026-09-08

RISK INFORMATION (Score: 6.5)

cvss3

Base Score: 6.5

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impact Score

3.6

Exploitability

2.8

REFERENCES

https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…

Badge your company to reduce your risk score and your cyber insurance costs!

Trusted by insurers. Chosen by leaders.

T-Systems Romania Vendor Cyber Rating & Cyber Score

T-Systems Romania A.I CyberSecurity Scoring

T-Systems Romania CyberSecurity News & History

T-Systems Romania Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for T-Systems Romania

Incidents vs IT Services and IT Consulting Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types T-Systems Romania vs IT Services and IT Consulting Industry Avg (This Year)

Incident History - T-Systems Romania (X = Date, Y = Severity)

T-Systems Romania Subsidiaries

T-Systems Romania

T-Systems Romania Similar Companies

Engineering Group

Swisscom

Sutherland

AeC

IGT Solutions

Apex Systems

SoftwareOne

Lenovo

Hexaware Technologies

T-Systems Romania CyberSecurity News

Prioritizing Cybersecurity in the Digital Age: Over 350 specialists gathered in Cluj-Napoca, at the Cybersecurity in Energy Forum, organized by DEER in partnership with the Ministry of Energy

Security concerns over system at heart of digital ID

Mircea Abrudean, President of the Senate: “Cybersecurity is a fundamental condition for the safe operation of energy systems”

SCUT brings a unified vision on digital protection - a cybersecurity architecture that eliminates fragmentation between systems

Revealed: Hundreds of passwords linked to government departments leaked on dark web

Cybersecurity is no longer just a technical challenge – it's a leadership one

ABB’s new gas chromatograph integrates cybersecurity to protect industrial systems

Russia suspected of cyber attack on Heathrow and European airports

Romanian consortium led by certSIGN to support the European Union Agency for Cybersecurity in strengthening cybersecurity in Romania under NIS2 Directive

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo

T-Systems Romania CyberSecurity News & History

T-Systems Romania Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for T-Systems Romania

Incidents vs IT Services and IT Consulting Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types T-Systems Romania vs IT Services and IT Consulting Industry Avg (This Year)

Incident History - T-Systems Romania (X = Date, Y = Severity)

T-Systems Romania Subsidiaries

T-Systems Romania

T-Systems Romania Similar Companies

Engineering Group

Swisscom

Sutherland

AeC

IGT Solutions

Apex Systems

SoftwareOne

Lenovo

Hexaware Technologies

T-Systems Romania CyberSecurity News

Prioritizing Cybersecurity in the Digital Age: Over 350 specialists gathered in Cluj-Napoca, at the Cybersecurity in Energy Forum, organized by DEER in partnership with the Ministry of Energy

Security concerns over system at heart of digital ID

Mircea Abrudean, President of the Senate: “Cybersecurity is a fundamental condition for the safe operation of energy systems”

SCUT brings a unified vision on digital protection - a cybersecurity architecture that eliminates fragmentation between systems

Revealed: Hundreds of passwords linked to government departments leaked on dark web

Cybersecurity is no longer just a technical challenge – it's a leadership one

ABB’s new gas chromatograph integrates cybersecurity to protect industrial systems

Russia suspected of cyber attack on Heathrow and European airports

Romanian consortium led by certSIGN to support the European Union Agency for Cybersecurity in strengthening cybersecurity in Romania under NIS2 Directive

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo