CVE-2026-44472
Received Received - Intake

Account Activation Flaw in Saleor Exposes User Data

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use accountRegister to create an account with a victim's email address before the victim registers. If the victim follows the activation link sent to that mailbox, Saleor activates the attacker-created account and saleor/graphql/account/mutations/account/confirm_account.py can merge anonymous orders and gift-card data for the same email address without requiring the account password or another authentication factor. The attacker can then access the merged order history and personal data, including names, addresses, and phone numbers. The patched supported lines disable automatic merging by default, while the redesigned 3.24.0 flow requires password confirmation before anonymous objects are linked. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-44472
EUVD
EUVD-2026-61069

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
saleor saleor From 2.10.0rc1 (inc) to 3.21.67 (inc)
saleor saleor 3.21.67
saleor saleor 3.22.63
saleor saleor 3.23.22
saleor saleor 3.24.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an account pre-hijacking vulnerability in the Saleor e-commerce platform. An attacker registers an account using a victim's email before the victim does. When the victim clicks the account activation link, Saleor merges the victim's existing anonymous orders and gift cards with the attacker's account without requiring additional authentication. This allows the attacker to access the victim's personal data like names, addresses, and phone numbers.

Detection Guidance

Detecting this vulnerability requires checking Saleor versions and monitoring for suspicious account activations. Verify installed versions against patched releases (3.21.67, 3.22.63, 3.23.22). Check logs for multiple account registrations with the same email or unexpected account merges. Use GraphQL queries to inspect account confirmation flows for improper data associations.

Impact Analysis

If you are a Saleor user, an attacker could gain access to your order history, gift card balances, and personal information such as your name, address, and phone number. This could lead to identity theft, financial loss, or privacy violations. As a store owner, your customers' data could be compromised, resulting in legal and reputational damage.

Compliance Impact

This vulnerability could lead to unauthorized access to personally identifiable information (PII), violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Organizations using affected Saleor versions may face compliance violations, legal penalties, and loss of customer trust due to potential data breaches.

Mitigation Strategies

Upgrade Saleor to versions 3.21.67, 3.22.63, or 3.23.22 immediately. Disable automatic merging of anonymous data in shop settings. Implement rate-limiting and CAPTCHA for account registration. Replace account activation links with password reset links. Monitor for unauthorized account merges and review logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart