CVE-2026-35407

April 8, 2026, 9:26 p.m.

5.9
Medium

Description

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's new_email, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Product(s) Impacted

Vendor Product Versions
Saleor
  • Saleor
  • 2.10.0-3.22.47, 3.22.47, 3.21.54, 3.20.118, <3.23.0a3

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-285
Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a saleor saleor 2.10.0-3.22.47 / / / / / / /
a saleor saleor 3.22.47 / / / / / / /
a saleor saleor 3.21.54 / / / / / / /
a saleor saleor 3.20.118 / / / / / / /
a saleor saleor <3.23.0a3 / / / / / / /

References

https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64
https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8
https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a
https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa
https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464
https://github.com/saleor/saleor/security/advisories/GHSA-hwph-9537-mc3p

Tags

[email protected]
CWE-285
2026-04-08
CVE-2026-35407

CVSS Score

5.9 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Attack Requirements: PRESENT
  • Privileges Required: LOW
  • User Interaction: PASSIVE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: HIGH
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: April 8, 2026, 7:25 p.m.
Last Modified: April 8, 2026, 9:26 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.