PT-2026-31392 · Saleor · Saleor

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-35407

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Saleor versions 2.10.0 through 3.22.47, 3.21.54, and 3.20.118

Description A business-logic and authorization flaw exists in the account email change workflow. The confirmation flow does not verify that the email change confirmation token was issued for the authenticated user. A valid email-change token generated for one account can be replayed while authenticated as a different account, leading to unauthorized email address modification. The new email within the token is used to update the second account’s email address, even if the token was not originally intended for that account.

Recommendations Update to Saleor version 3.23.0a3 or later. Update to Saleor version 3.22.47 or later. Update to Saleor version 3.21.54 or later. Update to Saleor version 3.20.118 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-35407

Affected Products

Saleor

References · 8

• https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64 · Patch
• https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8 · Patch
• https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a · Patch
• https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464 · Patch
• https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa · Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-hwph-9537-mc3p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35407 · Security Note
• https://twitter.com/CVEnew/status/2041975618087113053 · Twitter Post