CVE-2026-44472: Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use accountRegister to create an account with a victim's email address before the victim registers. If the victim follows the activation link sent to that mailbox, Saleor activates the attacker-created account and saleor/graphql/account/mutations/account/confirmaccount.py can merge anonymous orders and gift-card data for the same email address without requiring the account password or another authentication factor. The attacker can then access the merged order history and personal data, including names, addresses, and phone numbers. The patched supported lines disable automatic merging by default, while the redesigned 3.24.0 flow requires password confirmation before anonymous objects are linked. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.21.67 - Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.22.63 - Upgrade
Upgrade
Saleorto a version that resolves this vulnerability.Fixed in 3.23.22 - Configuration
In Saleor versions where this issue is addressed but before upgrading, ensure the patched setting that disables automatic merging of anonymous commerce data by default is set to disabled, so activation via email verification does not automatically merge anonymous orders/gift-card data.
Saleor automatic anonymous order merge (account activation flow) = disabled (default for patched supported lines)
Event History
Frequently Asked Questions
Which versions address this issue?
Install 3.21.67, 3.22.63, or 3.23.22, depending on the supported release line in use. Version 3.24.0 also redesigns the flow to require password confirmation before anonymous objects are linked.
What conditions are required for exploitation?
An attacker only needs to register an account using the victim's email address before the victim does. Exploitation then depends on the victim activating that attacker-created account through the link delivered to their mailbox; the attacker does not need the victim's password or another authentication factor for the anonymous-data merge.
What information could be exposed?
The exposed data can include merged anonymous order history, gift-card data, and associated personal information such as names, addresses, and phone numbers. The attacker can access this information through the activated attacker-created account.
Are default configurations affected after upgrading?
In the patched supported release lines, automatic merging is disabled by default. The 3.24.0 flow instead requires password confirmation before linking anonymous objects.