Broken Authorization in Saleor E-commerce Platform
CVE-2026-48744
What is CVE-2026-48744?
The Saleor e-commerce platform has a critical flaw that allows unauthenticated users to bypass authorization checks for specific GraphQL requests. The vulnerability exists in the permission utility found at saleor/permission/utils.py and affects versions beginning from 3.14.67. This issue permits anonymous users to alter channel order settings such as allowUnpaidOrders via the channelUpdate() mutation, circumventing expected permission restrictions. Additionally, it can expose sensitive hidden objects through pageType() and translation() queries, revealing attributes invisible to the storefront that should only be accessible to authorized management users. The vulnerability has been addressed in subsequent releases 3.21.67, 3.22.63, and 3.23.22.
Affected Version(s)
saleor >= 3.14.67, < 3.21.67 < 3.14.67, 3.21.67
saleor >= 3.22.0-a.0, < 3.22.63 < 3.22.0-a.0, 3.22.63
saleor >= 3.23.0-a.0, < 3.23.22 < 3.23.0-a.0, 3.23.22