CVE-2026-44472

Name of the Vulnerable Software and Affected Versions Saleor versions 2.10.0rc1 through 3.21.66 Saleor versions 3.22.0 through 3.22.62 Saleor versions 3.23.0 through 3.23.21

Description The account activation flow incorrectly treats email verification as sufficient proof of ownership, automatically associating anonymous commerce data with newly activated accounts. An attacker can use the accountRegister function to create an account using a victim's email address. If the victim clicks the activation link, the system activates the attacker's account and the saleor/graphql/account/mutations/account/confirm account.py endpoint merges anonymous orders and gift-card data for that email without requiring a password or additional authentication. This allows the attacker to access the victim's personal data, including names, addresses, phone numbers, and order history.

Recommendations Update to version 3.21.67. Update to version 3.22.63. Update to version 3.23.22. Update to version 3.24.0 or later to utilize the redesigned flow requiring password confirmation before linking anonymous objects.