Vulnerability details
CVE-2026-24136
saleor saleor
Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
CVSS 4.0
8.7High
Official description
Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 could have PIIs exfiltrated. The issue has been patched in Saleor versions: 3.22.29, 3.21.45, and 3.20.110. To workaround, temporarily block non-staff users from fetching order information (the order() GraphQL query) using a WAF.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| saleor | saleor | >= 3.2.0, < 3.20.110 | CVEProject cvelistV5 (CNA) |
| saleor | saleor | >= 3.21.0-a.0, < 3.21.45 | CVEProject cvelistV5 (CNA) |
| saleor | saleor | >= 3.22.0-a.0, < 3.22.29 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr x_refsource_CONFIRM
- https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa x_refsource_MISC
- https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af x_refsource_MISC
- https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153 x_refsource_MISC
- https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-24
- Last updated
- 2026-01-26
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.4%
Probability of exploitation in 30 days
34.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-639Authorization Bypass Through User-Controlled Key