PT-2026-31393 · Saleor · Saleor

CVE-2026-39851

·

Published

2026-04-08

·

Updated

2026-04-08

CVSS v4.0

5.3

Medium

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Saleor versions 2.10.0 through 3.20.117 Saleor versions 3.21.0 through 3.21.53 Saleor versions 3.22.0 through 3.22.46 Saleor versions 3.23.0a1 through 3.23.0a2
Description The requestEmailChange() mutation reveals whether a user-provided email address exists within the system by disclosing this information through error messages.
Recommendations Update to version 3.20.118 Update to version 3.21.54 Update to version 3.22.47 Update to version 3.23.0a3

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-39851
GHSA-M3RM-M4VQ-27X7

Affected Products

Saleor