CVE-2019-1010304

Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated...

CVE-2019-1010304

CVE-2019-1010304 affects Saleor’s GraphQL API (ProductVariant in the GraphQL schema) where Incorrect Access Control allowed an unauthenticated user to access data via the publicly exposed /graphql/ endpoint. The issue enables exposure of potentially admin-restricted shop revenue data. Impact is d...

HackerOne: Team object exposes amount of participants in a private program to non-invited users

Summary: Hello. Similar to other reports, suddenly after the update with ordering users, the GraphQL API is exposing the amount of participants in a private program to non-invited users. This allows an attacker to retrieve the amount of participants in a private program, as well as their details...