Saleor has a user enumeration vulnerability due to different error messages
Priority LOW 24CWE-204Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-204.
Summary
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00252 16th percentileScored 2026-11-07
Fix Fixed saleor (saleor): 3.20.118, 3.21.54, 3.22.47 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| saleor | saleor | 2.10.0 to before 3.20.118; 3.21.0-a.0 to before 3.21.54; 3.22.0-a.0 to before 3.22.47; 3.23.0-a.0 to before 3.23.0a3 | 3.20.118, 3.21.54, 3.22.47, 3.23.0a3 | Patch available | CNA |
- saleor Vendorsaleor Affected 2.10.0 to before 3.20.118; 3.21.0-a.0 to before 3.21.54; 3.22.0-a.0 to before 3.22.47; 3.23.0-a.0 to before 3.23.0a3 Fixed in 3.20.118, 3.21.54, 3.22.47, 3.23.0a3 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:* | 2.10.0 to before 3.20.118; 3.21.0 to before 3.21.54; 3.22.0 to before 3.22.47 | Vulnerable | saleor |
| cpe:2.3:a:saleor:saleor:3.23.0:alpha0:*:*:*:*:*:* | 3.23.0 alpha0 | Vulnerable | saleor |
| cpe:2.3:a:saleor:saleor:3.23.0:alpha1:*:*:*:*:*:* | 3.23.0 alpha1 | Vulnerable | saleor |
| cpe:2.3:a:saleor:saleor:3.23.0:alpha2:*:*:*:*:*:* | 3.23.0 alpha2 | Vulnerable | saleor |
- cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:* Versions 2.10.0 to before 3.20.118; 3.21.0 to before 3.21.54; 3.22.0 to before 3.22.47 Vulnerable ·saleor
- cpe:2.3:a:saleor:saleor:3.23.0:alpha0:*:*:*:*:*:* Versions 3.23.0 alpha0 Vulnerable ·saleor
- cpe:2.3:a:saleor:saleor:3.23.0:alpha1:*:*:*:*:*:* Versions 3.23.0 alpha1 Vulnerable ·saleor
- cpe:2.3:a:saleor:saleor:3.23.0:alpha2:*:*:*:*:*:* Versions 3.23.0 alpha2 Vulnerable ·saleor
Remediation
- Fix · CNA saleor (saleor) Fixed in 3.20.118, 3.21.54, 3.22.47, 3.23.0a3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-39851
References
Patch 6
- https://github.com/saleor/saleor/security/advisories/GHSA-m3rm-m4vq-27x7
- https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64
- https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8
- https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a
- https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa
- https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464
More Saleor vulnerabilities
- TI-2026-19454 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API CVSS 4.0HIGH 8.7
- TI-2026-27537 Saleor has a resource exhaustion vulnerability in GraphQL queries CVSS 3.1HIGH 7.5
- TI-2026-26135 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching CVSS 3.1HIGH 7.5
- TI-2026-18932 Saleor vulnerable to stored XSS via Unrestricted File Upload CVSS 4.0HIGH 8.5
- TI-2026-18341 Saleor lacks proper HTML sanitization in rich text fields CVSS 4.0HIGH 7.2
- TI-2022-18651 Improper object type validation in saleor CVSS 3.1MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences