CVE-2026-24136

🗓️ 23 Jan 2026 23:38:31Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 22 Views🌐 WEB

Saleor GraphQL IDOR exposes orders to unauthenticated users; patches include 3.20.110.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-24136	23 Jan 202623:38	–	attackerkb
GithubExploit	Exploit for Authorization Bypass Through User-Controlled Key in Saleor	12 Jun 202614:16	–	githubexploit
Circl	CVE-2026-24136	12 Jun 202621:00	–	circl
CNNVD	Saleor security vulnerabilities	24 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-24136 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API	23 Jan 202623:38	–	cvelist
NVD	CVE-2026-24136	24 Jan 202600:15	–	nvd
OSV	CVE-2026-24136 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API	23 Jan 202623:38	–	osv
Positive Technologies	PT-2026-4536	23 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-24136	26 Jan 202615:10	–	redhatcve
Snyk	Authorization Bypass Through User-Controlled Key	24 Jan 202600:51	–	snyk

NVD

Vulners

Node

saleor saleorRange3.2.0–3.20.110

saleor saleorRange3.21.0–3.21.45

saleor saleorRange3.22.0–3.22.29

[
  {
    "vendor": "saleor",
    "product": "saleor",
    "versions": [
      {
        "version": ">= 3.22.0-a.0, < 3.22.29",
        "status": "affected"
      },
      {
        "version": ">= 3.21.0-a.0, < 3.21.45",
        "status": "affected"
      },
      {
        "version": ">= 3.2.0, < 3.20.110",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa
github	www.github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr
github	www.github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944
github	www.github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af
github	www.github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153

Parameter	Position	Path	Description	CWE
id	request body	/graphql/	Unauthenticated access to GraphQL order query can exfiltrate PII (order data) due to missing authorization checks.	CWE-639

17 Jun 2026 10:22Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5

CVSS 48.7

EPSS0.00364

SSVC

CWE-639