Executive Summary

CVE-2026-35407 is a business-logic and authorization flaw in the Saleor e-commerce platform's account email change workflow. The confirmation process does not verify that the email change confirmation token was issued for the currently authenticated user.

As a result, a valid email-change token generated for one account can be reused by an attacker authenticated as a different user to change that second user’s email address to the attacker-controlled email specified in the token.

This allows an attacker who can authenticate to one account and obtain a valid email-change token to hijack another user’s account by re-binding it to an email address they control, effectively converting temporary access into a persistent account takeover.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full account compromise by allowing an attacker to change the email address of another user's account to one they control.

Once the attacker controls the email address associated with the victim's account, they can reset passwords and recover the victim account, resulting in unauthorized access and loss of account integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Saleor e-commerce platform to one of the fixed versions: 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118.

No workarounds are known for this issue, so applying the official patch is the only effective mitigation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to hijack user accounts by reusing email-change tokens issued for other accounts, leading to unauthorized modification of user email addresses and potential full account compromise.

Such unauthorized access and modification of user account information can undermine the integrity and security of personal data, which are critical requirements under regulations like GDPR and HIPAA.

Specifically, GDPR mandates protection of personal data against unauthorized access and alteration, and HIPAA requires safeguarding electronic protected health information (ePHI) to ensure confidentiality, integrity, and availability.

Therefore, this vulnerability could lead to non-compliance with these standards by exposing user data to unauthorized changes and potential account takeover, increasing the risk of data breaches and privacy violations.

Useful 0 Not Useful 0