CVE-2026-48744

Name of the Vulnerable Software and Affected Versions Saleor versions 3.14.67 through 3.21.66 Saleor versions 3.22.0 through 3.22.62 Saleor versions 3.23.0 through 3.23.21

Description A broken authorization check in saleor/permission/utils.py allows unauthenticated GraphQL requests to be incorrectly authorized. This flaw enables anonymous users to utilize the channelUpdate() mutation to modify channel order settings, such as allowUnpaidOrders, despite the system reporting a PermissionDenied response. Additionally, the same utility can expose hidden objects via the pageType() and translation() queries, revealing attributes where the visibleInStorefront field is set to false and should be restricted to users with management permissions.

Recommendations Update to version 3.21.67. Update to version 3.22.63. Update to version 3.23.22.