Saleor

v3.23.22 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1d Productivity & Wikis

✓ No known CVEs patched

This release patches 2 known CVEs

Topics

cart checkout commerce composable e-commerce ecommerce

+12 more

graphql headless headless-commerce multichannel oms order-management payments pim python shop shopping-cart store

Affected surfaces

auth rbac

Summary

AI summary

Fixed two critical CVEs: account pre-hijacking and anonymous GraphQL authorization bypass.

Full changelog

Changes:

Fixed CVE-2026-44472 - Account pre-hijacking vulnerability due to unverified anonymous order merge by @NyanKiyoshi in https://github.com/saleor/saleor/commit/42516727823cb74cb6b875070956debecf9ffdb8
Fixed CVE-2026-48744 - Anonymous users can bypass authorization checks in selected GraphQL paths by @NyanKiyoshi in https://github.com/saleor/saleor/commit/afd1ddd13b79e78db4e05f846b1f159078c50417
tests: add missing test for old_id when fetching orders by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19540

Thanks to @0xSmiley and @pavelkohout396 for reporting the issues!

[!NOTE]
Make sure to follow our upgrade guide if you use the confirmAccount() mutation (CVE-2026-44472).

Full Changelog: https://github.com/saleor/saleor/compare/3.23.21...3.23.22

CVE-2026-44472 – Account pre‑hijacking vulnerability due to unverified anonymous order merge
CVE-2026-48744 – Anonymous users can bypass authorization checks in selected GraphQL paths

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Saleor

Get notified when new releases ship.

About Saleor

Django based open-sourced e-commerce storefront.