CVE-2026-35407
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Saleor from 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118 has a business-logic and authorization flaw in the email change workflow. An email change token generated for one account can be replayed while authenticated as a different account, changing the second account's email to the token's new_email.
Risk Assessment
An attacker can take over another user's account by changing their email, enabling password reset and full account takeover.
Recommendation
Update Saleor to version 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118.
Original NVD description (English source)
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's new_email, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.