CVE-2026-39851: Saleor user enumeration in requestEmailChange mutation

CVE-2026-39851 · Severity: medium · CVSS 4.3 · Published 2026-04-08

Saleor is an e-commerce platform used to manage online storefronts. A security flaw in the email change process allowed the system to reveal whether specific email addresses were already registered in the database through descriptive error messages. An attacker could use this to identify valid customer accounts, potentially leading to targeted phishing attacks or further account compromise attempts.

Technologies: Saleor. Vendors: Saleor.

Quick answers

Is CVE-2026-39851 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39851 being exploited in the wild.
How severe is CVE-2026-39851?
Medium severity, with a CVSS score of 4.3, published 8 April 2026.
Which products and versions are affected?
Saleor >= 2.10.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3.
Is there a fix for CVE-2026-39851?
A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39851 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39851?
Check whether you run Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A user enumeration vulnerability exists in Saleor's GraphQL API due to an observable response discrepancy (CWE-204). The 'requestEmailChange()' mutation returns different error messages depending on whether a provided email address exists in the system. A remote attacker with low privileges (a registered account) can exploit this over the network to verify the existence of other users' email addresses. This information can be used for reconnaissance, spear-phishing, or building a target list of customers. The issue is resolved in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118 by standardizing error responses.

Affected products

  • Saleor Saleor >= 2.10.0, < 3.20.118; >= 3.21.0, < 3.21.54; >= 3.22.0, < 3.22.47; >= 3.23.0, < 3.23.0a3

Timeline

  • 2026-04-08: disclosed
  • 2026-04-08: advisory
  • 2026-04-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.