Executive brief
Saleor is an e-commerce platform used to manage online storefronts. A security flaw in the account management system allows an attacker to change another user's email address by reusing a security token intended for a different account. This could allow an attacker to take permanent control of a victim's account by redirecting password reset emails to an address they control.
Technical details
A business-logic and authorization vulnerability exists in Saleor's account email change workflow due to improper validation of confirmation tokens. The system fails to verify that an email change confirmation token was issued specifically for the currently authenticated user. An attacker with low privileges (a standard account) can generate a token for their own account and then replay that token while authenticated as a different user. This results in the second account's email address being updated to the attacker-specified address. This flaw can be leveraged for account takeover by utilizing subsequent password reset flows. The issue is fixed in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Affected products
- Saleor Saleor >= 2.10.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched
References
- https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64
- https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8
- https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a
- https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa
- https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464
- https://github.com/saleor/saleor/security/advisories/GHSA-hwph-9537-mc3p