CVE-2026-48744

Received Received - Intake

Broken Authorization in Saleor E-Commerce Platform

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate() mutation to change channel order settings such as allowUnpaidOrders even when the response reports PermissionDenied. The same permission utility can expose hidden objects through the pageType() and translation() queries, including attributes whose visibleInStorefront field is false and that should be visible only to users with management permissions. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-48744

EUVD

EUVD-2026-61068

Affected Vendors & Products

Vendor	Product	Version / Range
saleor	saleor	From 3.14.67 (inc) to 3.21.67 (inc)
saleor	saleor	3.22.63
saleor	saleor	3.23.22

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Saleor, an e-commerce platform, allows unauthenticated users to bypass authorization checks in GraphQL endpoints. It affects versions between 3.14.67 and below 3.23.22, 3.22.63, and 3.21.67. The flaw enables anonymous users to modify channel settings like allowUnpaidOrders and access hidden attributes that should only be visible to management users.

Detection Guidance

Check Saleor version with: curl -s https://your-saleor-instance.com/graphql | grep -i version. If running versions between 3.14.67 and below 3.23.22, 3.22.63, or 3.21.67, the system is vulnerable. Test GraphQL mutations like channelUpdate and queries like pageType for unauthorized access.

Monitor logs for unauthorized GraphQL mutation attempts, especially channelUpdate, and verify if hidden attributes (visibleInStorefront: false) are exposed in responses.

Impact Analysis

Unauthenticated users could alter critical e-commerce settings, such as payment and order configurations, leading to financial or operational disruptions. It may also expose sensitive hidden data, compromising confidentiality and integrity of store data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Exposure of hidden attributes may result in non-compliance with data privacy regulations.

Mitigation Strategies

Upgrade Saleor to versions 3.21.67, 3.22.63, or 3.23.22 or later immediately. Temporarily block public access to the channelUpdate mutation via firewall or GraphQL schema restrictions.

Review and audit GraphQL responses for exposed hidden attributes. Implement strict authentication and authorization checks for all GraphQL endpoints.

Hi! I’m here to help you understand CVE-2026-48744. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70