FKIE_CVE-2026-48744

Vulnerability from fkie_nvd - Published: 2026-08-18 17:16 - Updated: 2026-08-19 19:17
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate() mutation to change channel order settings such as allowUnpaidOrders even when the response reports PermissionDenied. The same permission utility can expose hidden objects through the pageType() and translation() queries, including attributes whose visibleInStorefront field is false and that should be visible only to users with management permissions. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.
References
security-advisories@github.comhttps://github.com/saleor/saleor/commit/11efb4e9ea76942cf142bc01de8846cbaf764465
security-advisories@github.comhttps://github.com/saleor/saleor/commit/580b93b6e0faef7800e667f0c3bc507d3ef6f5f5
security-advisories@github.comhttps://github.com/saleor/saleor/commit/9b1f59b3ed86c3fad3ce071639cf434c1ab94a85
security-advisories@github.comhttps://github.com/saleor/saleor/commit/afd1ddd13b79e78db4e05f846b1f159078c50417
security-advisories@github.comhttps://github.com/saleor/saleor/releases/tag/3.21.67
security-advisories@github.comhttps://github.com/saleor/saleor/releases/tag/3.22.63
security-advisories@github.comhttps://github.com/saleor/saleor/releases/tag/3.23.22
security-advisories@github.comhttps://github.com/saleor/saleor/security/advisories/GHSA-xqqq-qhgq-gx53
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "saleor",
          "vendor": "saleor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.14.67, \u003c 3.21.67"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.22.0-a.0, \u003c 3.22.63"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.23.0-a.0, \u003c 3.23.22"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate() mutation to change channel order settings such as allowUnpaidOrders even when the response reports PermissionDenied. The same permission utility can expose hidden objects through the pageType() and translation() queries, including attributes whose visibleInStorefront field is false and that should be visible only to users with management permissions. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22."
    }
  ],
  "id": "CVE-2026-48744",
  "lastModified": "2026-08-19T19:17:17.293",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48744",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-19T18:17:30.626617Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-18T17:16:57.533",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/saleor/saleor/commit/11efb4e9ea76942cf142bc01de8846cbaf764465"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/saleor/saleor/commit/580b93b6e0faef7800e667f0c3bc507d3ef6f5f5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/saleor/saleor/commit/9b1f59b3ed86c3fad3ce071639cf434c1ab94a85"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/saleor/saleor/commit/afd1ddd13b79e78db4e05f846b1f159078c50417"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/saleor/saleor/releases/tag/3.21.67"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/saleor/saleor/releases/tag/3.22.63"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/saleor/saleor/releases/tag/3.23.22"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/saleor/saleor/security/advisories/GHSA-xqqq-qhgq-gx53"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.