Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.
Summary
Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate() mutation to change channel order settings such as allowUnpaidOrders even when the response reports PermissionDenied. The same permission utility can expose hidden objects through the pageType() and translation() queries, including attributes whose visibleInStorefront field is false and that should be visible only to users with management permissions. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| saleor | saleor | 3.14.67 to before 3.21.67; 3.22.0-a.0 to before 3.22.63; 3.23.0-a.0 to before 3.23.22 | 3.21.67, 3.22.63, 3.23.22 | Patch available | CNA |
- saleor Vendorsaleor Affected 3.14.67 to before 3.21.67; 3.22.0-a.0 to before 3.22.63; 3.23.0-a.0 to before 3.23.22 Fixed in 3.21.67, 3.22.63, 3.23.22 Patch available CNA
Remediation
- Fix · CNA saleor (saleor) Fixed in 3.21.67, 3.22.63, 3.23.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48744
References
Other 8
- https://github.com/saleor/saleor/security/advisories/GHSA-xqqq-qhgq-gx53
- https://github.com/saleor/saleor/commit/11efb4e9ea76942cf142bc01de8846cbaf764465
- https://github.com/saleor/saleor/commit/580b93b6e0faef7800e667f0c3bc507d3ef6f5f5
- https://github.com/saleor/saleor/commit/9b1f59b3ed86c3fad3ce071639cf434c1ab94a85
- https://github.com/saleor/saleor/commit/afd1ddd13b79e78db4e05f846b1f159078c50417
- https://github.com/saleor/saleor/releases/tag/3.21.67
- https://github.com/saleor/saleor/releases/tag/3.22.63
- https://github.com/saleor/saleor/releases/tag/3.23.22
More saleor vulnerabilities
- TI-2026-19454 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API CVSS 4.0HIGH 8.7
- TI-2026-27537 Saleor has a resource exhaustion vulnerability in GraphQL queries CVSS 3.1HIGH 7.5
- TI-2026-26135 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching CVSS 3.1HIGH 7.5
- TI-2026-32411 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge CVSS 3.1HIGH 8.1
- TI-2026-18932 Saleor vulnerable to stored XSS via Unrestricted File Upload CVSS 4.0HIGH 8.5
- TI-2026-18341 Saleor lacks proper HTML sanitization in rich text fields CVSS 4.0HIGH 7.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences