Insecure Direct Object Reference in Saleor E-Commerce Platform
CVE-2026-24136
What is CVE-2026-24136?
The Saleor e-commerce platform exhibits an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated users to retrieve sensitive information in plain text. Specifically, orders created prior to Saleor version 3.2.0 can have personally identifiable information (PII) exfiltrated. This vulnerability impacts versions 3.2.0 to 3.20.109, 3.21.0-a.0 through 3.21.44, and 3.22.0-a.0 through 3.22.28. To mitigate the issue temporarily, users are advised to restrict non-staff access to sensitive order information by implementing a Web Application Firewall (WAF) to block the order() GraphQL query. Updated versions are available as a permanent fix.
Affected Version(s)
saleor >= 3.22.0-a.0, < 3.22.29 < 3.22.0-a.0, 3.22.29
saleor >= 3.21.0-a.0, < 3.21.45 < 3.21.0-a.0, 3.21.45
saleor >= 3.2.0, < 3.20.110 < 3.2.0, 3.20.110