CVE-2026-24136-Lab

CVE-2026-24136 - Saleor GraphQL IDOR / 未認証PII流出 概要...

CVE-2022-39275

CVE-2022-39275 CVE-2022-39275 の POC。 アドバイザリのリソース: NIST NVD CVE.org Github セキュリティアドバイザリ これはコミットハッシュ 47f9f5fb29be2b5892c79ace4f23022f397a0a5e のフォークです link。git サブモジュールも変更する必要があったため、単に再プッシュされました。 POC-Setup セットアップガイド setup guide に従ってください。古くなっている場合に備えて、手順を以下に示します: root@kitploit: cd saleor-platform dock...

CVE-2026-23499

CVE-2026-23499: Saleor vulnerable to stored XSS via Unrestricted File Upload Overview...

CVE-2026-22849

CVE-2026-22849: Saleor 富文本字段缺少适当的 HTML 净化处理 概述 字段| 详情 ---|--- CVE ID| CVE-2026-22849 严重性| HIGH 安全公告| 查看安全公告 发现者| Lukasz Rybak 受影响产品 saleor/saleor 详情 Saleor 允许用户使用 HTML 修改富文本字段，而未在后端运行任何 HTML 净化器，从而允许恶意行为者对仪表板和店面执行存储型 XSS 攻击。 影响 恶意员工可以构造脚本注入来针对其他员工，可能窃取他们的访问令牌和/或刷新令牌。 缓解措施...

CVE-2026-48744

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

CVE-2026-44472

Saleor (e-commerce platform) versions from 2.10.0rc1 through 3.21.67 , 3.22.63 , and 3.23.22 are affected by an account pre-hijacking vulnerability in the activation flow. The root cause is that email verification is treated as sufficient proof of account ownership, and confirm_account.py automat...

CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

EUVD-2026-61069

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

CVE-2026-44472

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

CVE-2026-48744 Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

CVE-2026-48744 Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

CVE-2026-48744

A logic flaw in Saleor's saleor/permission/utils.py — Python's all([]) evaluates to True — lets unauthenticated callers bypass authorization, enabling the channelUpdate() mutation to alter allowUnpaidOrders and exposing hidden objects via pageType()/translation() queries. Affected versions 3.14.6...

CVE-2026-48744

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

PYSEC-2026-917 Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions

Impact Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.1...

PYSEC-2026-915 Saleor Unauthenticated Information Disclosure Vulnerability via Python Exceptions

Impact Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. Affected versions: Saleor ≥ 2.0.0 Workarounds None For more information If you...

PYSEC-2026-916 Mirumee Saleor CSRF Protection Disabled

In Mirumee Saleor 2.7.0 fixed in 2.8.0, CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server...

PYSEC-2026-746 saleor Missing Authorization vulnerability

Missing Authorization in saleor prior to 3.1.2...

Exploit for Authorization Bypass Through User-Controlled Key in Saleor

CVE-2026-24136 - Saleor GraphQL IDOR / Unauthenticated PII Exf...

CVE-2026-39851

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118...