CVE-2022-39275

CVE-2022-39275 POC for CVE-2022-39275. Resources for the advisory: NIST NVD CVE.org Github Security Advisory This is a fork of commit hash: 47f9f5fb29be2b5892c79ace4f23022f397a0a5e link, just re-pushed as there were git submodules that also had to be changed. POC-Setup Follow the setup guide. In...

CVE-2026-23499

CVE-2026-23499: Saleor vulnerable to stored XSS via Unrestricted File Upload Overview...

CVE-2026-22849

CVE-2026-22849: Saleor lacks proper HTML sanitization in rich text fields Overview...

CVE-2026-24136-Lab

CVE-2026-24136 - Saleor GraphQL IDOR / Unauthenticated PII Exfiltration Overview...

CVE-2026-48744

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

CVE-2026-44472

Saleor (e-commerce platform) versions from 2.10.0rc1 through 3.21.67 , 3.22.63 , and 3.23.22 are affected by an account pre-hijacking vulnerability in the activation flow. The root cause is that email verification is treated as sufficient proof of account ownership, and confirm_account.py automat...

CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

EUVD-2026-61069

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

CVE-2026-44472

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

CVE-2026-48744 Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

CVE-2026-48744

A logic flaw in Saleor's saleor/permission/utils.py — Python's all([]) evaluates to True — lets unauthenticated callers bypass authorization, enabling the channelUpdate() mutation to alter allowUnpaidOrders and exposing hidden objects via pageType()/translation() queries. Affected versions 3.14.6...

CVE-2026-48744 Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

CVE-2026-48744

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

PYSEC-2026-917 Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions

Impact Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.1...

PYSEC-2026-915 Saleor Unauthenticated Information Disclosure Vulnerability via Python Exceptions

Impact Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. Affected versions: Saleor ≥ 2.0.0 Workarounds None For more information If you...

PYSEC-2026-916 Mirumee Saleor CSRF Protection Disabled

In Mirumee Saleor 2.7.0 fixed in 2.8.0, CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server...

PYSEC-2026-746 saleor Missing Authorization vulnerability

Missing Authorization in saleor prior to 3.1.2...

Exploit for Authorization Bypass Through User-Controlled Key in Saleor

CVE-2026-24136 - Saleor GraphQL IDOR / Unauthenticated PII Exf...

CVE-2026-39851

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118...