# CVE-2024-29888: Saleor information leak in Local stock only pickup method

Source: https://junglewise.ai/threats/cve-2024-29888-saleor-information-leak-in-local-stock-only-pickup-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-03-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2024-29888 · Severity: medium · CVSS 4.2 · Published 2024-03-28

Saleor is an e-commerce platform used by high-volume businesses to manage online stores. A flaw in the 'Local stock only' pickup delivery method allows a customer's private home address to accidentally overwrite a warehouse's public address. This results in the exposure of private customer location data to other users or the public, potentially impacting customer privacy and the company's reputation for data handling.

Technologies: [saleor (PyPI)](https://junglewise.ai/threats/technologies/pypi-saleor), [Saleor](https://junglewise.ai/threats/technologies/saleor). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Saleor](https://junglewise.ai/threats/vendors/saleor).

## Quick answers

**Is CVE-2024-29888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-29888 being exploited in the wild.

**How severe is CVE-2024-29888?** Medium severity, with a CVSS score of 4.2, published 28 March 2024.

**Which products and versions are affected?** saleor (PyPI) ECOSYSTEM:introduced=3.14.56,fixed=3.14.61, ECOSYSTEM:introduced=3.14.56,fixed=3.14.61,introduced=3.15.31,fixed=3.15.37,introduced=3.16.27,fixed=3.16.34,introduced=3.17.25,fixed=3.17.32,introduced=3.18.19,fixed=3.18.28,introduced=3.19.5,fixed=3.19.15; Saleor >= 3.14.56, < 3.14.61; >= 3.15.31, < 3.15.37; >= 3.16.27, < 3.16.34; >= 3.17.25, < 3.17.32; >= 3.18.19, < 3.18.28; >= 3.19.5, < 3.19.15.

**Is there a fix for CVE-2024-29888?** Yes. saleor (PyPI): upgrade to 3.14.61, 3.19.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-29888 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-29888?** Check whether you run saleor (PyPI) or Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- saleor (PyPI): upgrade to 3.14.61, 3.19.15 or later

  ```sh
  pip install "saleor>=3.19.15"
  ```


## Technical details

A vulnerability exists in Saleor's click-and-collect functionality, specifically when using the 'Pickup: Local stock only' delivery method. Under certain conditions, a customer's address can overwrite the warehouse address in the system, leading to the exposure of private personal information (CWE-359). The attack vector is network-based but requires high complexity and user interaction to trigger the specific conditions for the address overwrite. Successful exploitation results in a loss of confidentiality for customer data. Patches are available in versions 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, and 3.19.15.

## Affected products

- Saleor Saleor >= 3.14.56, < 3.14.61; >= 3.15.31, < 3.15.37; >= 3.16.27, < 3.16.34; >= 3.17.25, < 3.17.32; >= 3.18.19, < 3.18.28; >= 3.19.5, < 3.19.15

## Identifiers

- CVE-2024-29888
- GHSA-mrj3-f2h4-7w45
- PYSEC-2026-1890

## Timeline

- 2024-03-27: disclosed
- 2024-03-27: patched
- 2024-03-28: advisory

## References

- [https://github.com/saleor/saleor/security/advisories/GHSA-mrj3-f2h4-7w45](https://github.com/saleor/saleor/security/advisories/GHSA-mrj3-f2h4-7w45)
- [https://github.com/saleor/saleor/pull/15697](https://github.com/saleor/saleor/pull/15697)
- [https://github.com/saleor/saleor/pull/15694](https://github.com/saleor/saleor/pull/15694)
- [https://github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4](https://github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4)
- [https://github.com/saleor/saleor/commit/d8ba545c16ad3153febc5b5be8fd2ef75da9fc95](https://github.com/saleor/saleor/commit/d8ba545c16ad3153febc5b5be8fd2ef75da9fc95)

## Related threats

- [PYSEC-2026-916 - Mirumee Saleor CSRF Protection Disabled](https://junglewise.ai/threats/cve-2019-13594-mirumee-saleor-csrf-protection-disabled)
- [PYSEC-2026-746 - saleor Missing Authorization vulnerability](https://junglewise.ai/threats/cve-2022-0932-saleor-missing-authorization-vulnerability)
- [PYSEC-2026-747 - Missing Authentication for Critical Function in Saleor](https://junglewise.ai/threats/cve-2020-7964-missing-authentication-for-critical-function-in-saleor)
- [Saleor user enumeration in requestEmailChange mutation](https://junglewise.ai/threats/cve-2026-39851-saleor-user-enumeration-in-requestemailchange-mutation)
- [Saleor authorization bypass in email change workflow](https://junglewise.ai/threats/cve-2026-35407-saleor-authorization-bypass-in-email-change-workflow)