Insecure Direct Object Reference in Saleor E-Commerce Platform
CVE-2026-24136
Key Information:
Badges
What is CVE-2026-24136?
The Saleor e-commerce platform exhibits an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated users to retrieve sensitive information in plain text. Specifically, orders created prior to Saleor version 3.2.0 can have personally identifiable information (PII) exfiltrated. This vulnerability impacts versions 3.2.0 to 3.20.109, 3.21.0-a.0 through 3.21.44, and 3.22.0-a.0 through 3.22.28. To mitigate the issue temporarily, users are advised to restrict non-staff access to sensitive order information by implementing a Web Application Firewall (WAF) to block the order() GraphQL query. Updated versions are available as a permanent fix.
Affected Version(s)
saleor >= 3.22.0-a.0, < 3.22.29 < 3.22.0-a.0, 3.22.29
saleor >= 3.21.0-a.0, < 3.21.45 < 3.21.0-a.0, 3.21.45
saleor >= 3.2.0, < 3.20.110 < 3.2.0, 3.20.110
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.