Log in Start free

Vulnerability · Published Apr 8, 2026 · Assigned by GitHub_M

CVE-2026-35407Saleor has Cross-Account Email Change via Unbound Confirmation Token

Medium 6.5

In plain English

A medium-severity security flaw in saleor from saleor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 77.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's new_email, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Affected products (as reported)

VendorProductVersions
saleor saleor >= 2.10.0, < 3.20.118>= 3.21.0-a.0, < 3.21.54>= 3.22.0-a.0, < 3.22.47>= 3.23.0-a.0, < 3.23.0a3

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References