Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use accountRegister to create an account with a victim's email address before the victim registers. If the victim follows the activation link sent to that mailbox, Saleor activates the attacker-created account and saleor/graphql/account/mutations/account/confirm_account.py can merge anonymous orders and gift-card data for the same email address without requiring the account password or another authentication factor. The attacker can then access the merged order history and personal data, including names, addresses, and phone numbers. The patched supported lines disable automatic merging by default, while the redesigned 3.24.0 flow requires password confirmation before anonymous objects are linked. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| saleor | saleor | 2.10.0rc1 to before 3.21.67; 3.22.0-a.0 to before 3.22.63; 3.23.0-a.0 to before 3.23.22 | 3.21.67, 3.22.63, 3.23.22 | Patch available | CNA |
- saleor Vendorsaleor Affected 2.10.0rc1 to before 3.21.67; 3.22.0-a.0 to before 3.22.63; 3.23.0-a.0 to before 3.23.22 Fixed in 3.21.67, 3.22.63, 3.23.22 Patch available CNA
Remediation
- Fix · CNA saleor (saleor) Fixed in 3.21.67, 3.22.63, 3.23.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44472
- 2026-10-28 EPSS moved to the 50th–90th percentile
References
Other 8
- https://github.com/saleor/saleor/security/advisories/GHSA-6whj-8p3f-2xqp
- https://github.com/saleor/saleor/commit/299cdfb1a5737108b78b5c2c0d29b94f3b7331a2
- https://github.com/saleor/saleor/commit/42516727823cb74cb6b875070956debecf9ffdb8
- https://github.com/saleor/saleor/commit/5110542c164991384fa3c4f01983e8c76823ce0f
- https://github.com/saleor/saleor/commit/dc63e422afc9f6ce115d75f045886b01b4f13e2b
- https://github.com/saleor/saleor/releases/tag/3.21.67
- https://github.com/saleor/saleor/releases/tag/3.22.63
- https://github.com/saleor/saleor/releases/tag/3.23.22
More saleor vulnerabilities
- TI-2026-19454 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API CVSS 4.0HIGH 8.7
- TI-2026-27537 Saleor has a resource exhaustion vulnerability in GraphQL queries CVSS 3.1HIGH 7.5
- TI-2026-26135 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching CVSS 3.1HIGH 7.5
- TI-2026-18932 Saleor vulnerable to stored XSS via Unrestricted File Upload CVSS 4.0HIGH 8.5
- TI-2026-36015 Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check CVSS 3.1MEDIUM 6.5
- TI-2026-18341 Saleor lacks proper HTML sanitization in rich text fields CVSS 4.0HIGH 7.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences