CVE-2026-35407: Saleor has Cross-Account Email Change via Unbound Confirmation Token
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's newemail, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.23.0a3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.22.47 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.21.54 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.20.118
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35407?
CVE-2026-35407 has been classified as a business-logic and authorization flaw in the email change workflow, which can potentially lead to unauthorized email changes.
How do I fix CVE-2026-35407?
To fix CVE-2026-35407, upgrade Saleor to version 3.23.0 or later, as this addresses the vulnerability in the email change confirmation process.
What versions of Saleor are affected by CVE-2026-35407?
CVE-2026-35407 affects Saleor versions from 2.10.0 to before 3.23.0a3, including 3.22.47, 3.21.54, and 3.20.118.
What is the impact of CVE-2026-35407?
The impact of CVE-2026-35407 allows malicious actors to change account emails of users without proper verification, which could lead to account takeover.
Is CVE-2026-35407 a common vulnerability in e-commerce platforms?
CVE-2026-35407 is an example of a common business-logic flaw that can affect any e-commerce platform that does not properly validate email change requests.