CVE-2026-24136
IDOR Vulnerability in Saleor Exposes Sensitive Order Data
Publication date: 2026-01-24
Last updated on: 2026-02-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| saleor | saleor | From 3.2.0 (inc) to 3.20.110 (exc) |
| saleor | saleor | From 3.21.0 (inc) to 3.21.45 (exc) |
| saleor | saleor | From 3.22.0 (inc) to 3.22.29 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24136 is an Insecure Direct Object Reference (IDOR) vulnerability in the Saleor e-commerce platform's GraphQL API. It allows unauthenticated attackers to access and extract sensitive personally identifiable information (PII) such as email addresses, billing and shipping addresses, and invoices in plain text by exploiting improper authorization checks in the order() GraphQL query. The vulnerability arises from incorrect handling of the `use_old_id` flag in order data resolvers, which led to unauthorized users being able to retrieve sensitive order-related data without proper permissions. This issue affects Saleor versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44, and 3.22.0-a.0 through 3.22.28. The problem has been fixed by correcting the logic to ensure that sensitive data is only returned if the requester is authorized or is the owner of the order; otherwise, the data is obfuscated or withheld. [5, 1, 2, 3, 4]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive personal information such as customer email addresses, billing and shipping addresses, and invoice details. Since it allows unauthenticated actors to extract this data in plain text, it poses a significant privacy risk and could lead to identity theft, fraud, or other malicious activities targeting customers. Additionally, attackers could exploit this flaw remotely without any authentication or user interaction, making it easy to abuse. If you operate a Saleor e-commerce platform running vulnerable versions, your customers' sensitive data could be exposed, damaging your reputation and customer trust. [5]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring or testing access to the order() GraphQL query in Saleor installations, especially by unauthenticated or non-staff users. Since the vulnerability allows unauthorized extraction of sensitive order information, you can attempt to query order data without authentication or with a non-staff user to see if sensitive information such as billing/shipping addresses or user emails is returned in plain text. Specific commands would depend on your GraphQL client or API testing tools. For example, using curl or a GraphQL client, you can send a query to the order() endpoint and check if sensitive data is accessible without proper permissions. However, no explicit detection commands are provided in the resources. [5]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Saleor to one of the patched versions: 3.20.110, 3.21.45, or 3.22.29, which contain fixes that properly enforce access control and obfuscate sensitive data when the `use_old_id` flag is set. If upgrading immediately is not possible, a temporary workaround is to block non-staff users from accessing the order() GraphQL query using a Web Application Firewall (WAF) to prevent unauthorized data extraction. [5]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated actors to extract sensitive personally identifiable information (PII) such as email addresses and physical addresses in plain text due to insufficient authorization controls. This exposure of sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict protection of personal data and mandate controls to prevent unauthorized access. Therefore, organizations using vulnerable versions of Saleor may face compliance risks until they apply the patches or mitigations. [5]