[solidus_admin] [GHSA-3cfg-886h-22vf] Unrestricted type assignment in admin payment methods controller

[Jared Norman]

Versions Affected: solidus_admin installed from the `main` branch on or after 2026-09-19
Not affected: All released versions of solidus_admin (0.4.1 and earlier)
Fixed Versions: Fixed on the `main` branch; will be included in solidus_admin 0.5.0

Impact
------

The new admin payment methods controller does not validate that the passed
`type` for a payment method belongs to the configured accepted payment
methods.

Our old backend admin controller had a before action that would validate the
`type`, but it was missed when creating the new one.

Only stores running `solidus_admin` from the `main` branch on or after
2026-09-19 are affected. The published 0.4.0 gem does not include payment
method creation or editing in the new admin.

Patches
-------

The fix is on the `main` branch and will be included in `solidus_admin`
v0.5.0.

Workarounds
-----------

If you're unable to upgrade, you can revert to the old backend or add the
following initializer to fix the new admin controller:

    # config/initializers/payment_method_type_validation.rb
    Rails.application.config.to_prepare do
      SolidusAdmin::PaymentMethodsController.class_eval do
        before_action :validate_type, only: [:create, :update]

        private

        def available_types
          Rails.application.config.spree.payment_methods.map(&:name)
        end

        def validate_type
          unless available_types.include?(params[:payment_method][:type])
            @resource ||= resource_class.new(permitted_resource_params.except(:type))
            @resource.errors.add(:type, :invalid)

            page_component = @resource.persisted? ? edit_component.new(@resource) : new_component.new(@resource)
            render_resource_form_with_errors(page_component)
          end
        end
      end
    end

References
----------

* https://github.com/solidusio/solidus/security/advisories/GHSA-3cfg-886h-22vf

If you have any questions about how to secure your site please stop by our
Slack: http://slack.solidus.io/