PT-2026-4536 · Saleor · Saleor

Nyankiyoshi · Publicado 2026-01-23 · Atualizado 2026-01-24 · CVE-2026-24136

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Saleor versions 3.2.0 through 3.20.109 Saleor versions 3.21.0-a.0 through 3.21.44 Saleor versions 3.22.0-a.0 through 3.22.28

Description Saleor, an e-commerce platform, is affected by an Insecure Direct Object Reference (IDOR) issue. This allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 may have Personally Identifiable Information (PII) exfiltrated. The issue allows unauthorized access to data through direct object references.

Recommendations Update to Saleor version 3.22.29. Update to Saleor version 3.21.45. Update to Saleor version 3.20.110. Temporarily block non-staff users from fetching order information using the order() GraphQL query with a Web Application Firewall (WAF).

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-24136

GHSA-R6FJ-F4R9-36GR

Produtos afetados

Saleor

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24136.json · Exploit
• https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa · Correção
• https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr · Aviso do Fabricante
• https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944 · Correção
• https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153 · Correção
• https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af · Correção
• https://t.me/CVEtracker/42889 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-24136 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24136 · Nota de Segurança
• https://twitter.com/CVEnew/status/2014995821356552348 · Publicação no Twitter
• https://t.me/cveNotify/149769 · Publicação no Telegram