CVE-2026-39851: Saleor has a user enumeration vulnerability due to different error messages
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.23.0a3 - Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.22.47 - Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.21.54 - Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.20.118
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39851?
CVE-2026-39851 is classified as a user enumeration vulnerability with moderate severity, allowing attackers to confirm existing email addresses through error messages.
How do I fix CVE-2026-39851?
To fix CVE-2026-39851, update Saleor to version 3.23.0a3 or later, or the relevant patched versions listed in the vulnerability details.
Which versions of Saleor are affected by CVE-2026-39851?
CVE-2026-39851 affects Saleor versions from 2.10.0 to below 3.23.0a3, including specific versions like 3.22.47, 3.21.54, and 3.20.118.
What type of vulnerability is CVE-2026-39851?
CVE-2026-39851 is a user enumeration vulnerability that arises from disclosing user existence through inconsistent error messages.
Can CVE-2026-39851 lead to data exposure?
Yes, CVE-2026-39851 can lead to data exposure by allowing attackers to validate email addresses, which may assist in further attacks.