Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
Summary
| CVE | CVE-2026-44472 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-18 18:17:33 UTC |
| Updated | 2026-09-18 20:09:01 UTC |
| Description | Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use accountRegister to create an account with a victim's email address before the victim registers. If the victim follows the activation link sent to that mailbox, Saleor activates the attacker-created account and saleor/graphql/account/mutations/account/confirm_account.py can merge anonymous orders and gift-card data for the same email address without requiring the account password or another authentication factor. The attacker can then access the merged order history and personal data, including names, addresses, and phone numbers. The patched supported lines disable automatic merging by default, while the redesigned 3.24.0 flow requires password confirmation before anonymous objects are linked. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22. |
Risk And Classification
Primary CVSS: v3.1 8.1 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS: 0.004390000 probability, percentile 0.374730000 (date 2026-09-21)
Problem Types: CWE-287 | CWE-287 CWE-287: Improper Authentication
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| 3.1 | CNA | DECLARED | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/saleor/saleor/releases/tag/3.22.63 | [email protected] | github.com | |
| github.com/saleor/saleor/security/advisories/GHSA-6whj-8p3f-2xqp | [email protected] | github.com | |
| github.com/saleor/saleor/commit/5110542c164991384fa3c4f01983e8c76823ce0f | [email protected] | github.com | |
| github.com/saleor/saleor/releases/tag/3.23.22 | [email protected] | github.com | |
| github.com/saleor/saleor/releases/tag/3.21.67 | [email protected] | github.com | |
| github.com/saleor/saleor/commit/42516727823cb74cb6b875070956debecf9ffdb8 | [email protected] | github.com | |
| github.com/saleor/saleor/commit/299cdfb1a5737108b78b5c2c0d29b94f3b7331a2 | [email protected] | github.com | |
| github.com/saleor/saleor/commit/dc63e422afc9f6ce115d75f045886b01b4f13e2b | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.