CVE-2026-48744
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Saleor versions from 3.14.67 to 3.21.67, 3.22.63, and 3.23.22 have a broken authorization check in saleor/permission/utils.py that can incorrectly authorize unauthenticated GraphQL requests. This allows anonymous callers to use the channelUpdate() mutation to change channel order settings such as allowUnpaidOrders even when the response reports PermissionDenied. The same permission utility can expose hidden objects through pageType() and translation() queries, including attributes with visibleInStorefront set to false.
Risk Assessment
Unauthenticated users can modify channel settings and access hidden data, compromising the integrity and confidentiality of the e-commerce platform.
Recommendation
Upgrade Saleor to versions 3.21.67, 3.22.63, or 3.23.22, which contain the fix.
Original NVD description (English source)
Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate() mutation to change channel order settings such as allowUnpaidOrders even when the response reports PermissionDenied. The same permission utility can expose hidden objects through the pageType() and translation() queries, including attributes whose visibleInStorefront field is false and that should be visible only to users with management permissions. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.