PT-2026-4536 · Saleor · Saleor

Nyankiyoshi · Published 2026-01-23 · Updated 2026-01-24 · CVE-2026-24136

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Saleor versions 3.2.0 through 3.20.109 Saleor versions 3.21.0-a.0 through 3.21.44 Saleor versions 3.22.0-a.0 through 3.22.28

Description Saleor, an e-commerce platform, is affected by an Insecure Direct Object Reference (IDOR) issue. This allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 may have Personally Identifiable Information (PII) exfiltrated. The issue allows unauthorized access to data through direct object references.

Recommendations Update to Saleor version 3.22.29. Update to Saleor version 3.21.45. Update to Saleor version 3.20.110. Temporarily block non-staff users from fetching order information using the order() GraphQL query with a Web Application Firewall (WAF).

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-24136

GHSA-R6FJ-F4R9-36GR

Affected Products

Saleor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24136.json · Exploit
• https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa · Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr · Vendor Advisory
• https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944 · Patch
• https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153 · Patch
• https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af · Patch
• https://osv.dev/vulnerability/CVE-2026-24136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24136 · Security Note
• https://t.me/CVEtracker/42889 · Telegram Post
• https://twitter.com/CVEnew/status/2014995821356552348 · Twitter Post
• https://t.me/cveNotify/149769 · Telegram Post