CVE-2025-58442: Saleor has user enumeration vulnerability due to different error messages
Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of accountRegister may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58442?
CVE-2025-58442 has a medium severity rating due to the potential exposure of user existence information.
How do I fix CVE-2025-58442?
To fix CVE-2025-58442, upgrade Saleor to version 3.21.16 or later.
What is the main risk associated with CVE-2025-58442?
The main risk is that an attacker could determine if a specific email address is registered in Saleor.
Which versions of Saleor are affected by CVE-2025-58442?
Saleor versions 3.21.0 through 3.21.15 are affected by CVE-2025-58442.
Is user data compromised in CVE-2025-58442?
No user data is compromised; however, there is a risk of revealing user email registration status.