CVE-2026-24136

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24136", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.474Z", "datePublished": "2026-01-23T23:38:31.414Z", "dateUpdated": "2026-01-26T17:10:16.445Z"}, "containers": {"cna": {"title": "Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr"}, {"name": "https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa"}, {"name": "https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af"}, {"name": "https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153"}, {"name": "https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944"}], "affected": [{"vendor": "saleor", "product": "saleor", "versions": [{"version": ">= 3.22.0-a.0, < 3.22.29", "status": "affected"}, {"version": ">= 3.21.0-a.0, < 3.21.45", "status": "affected"}, {"version": ">= 3.2.0, < 3.20.110", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-23T23:38:31.414Z"}, "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 could have PIIs exfiltrated. The issue has been patched in Saleor versions: 3.22.29, 3.21.45, and 3.20.110. To workaround, temporarily block non-staff users from fetching order information (the order() GraphQL query) using a WAF."}], "source": {"advisory": "GHSA-r6fj-f4r9-36gr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T17:09:35.701674Z", "id": "CVE-2026-24136", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:10:16.445Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24136", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.474Z", "datePublished": "2026-01-23T23:38:31.414Z", "dateUpdated": "2026-01-26T17:10:16.445Z"}, "containers": {"cna": {"title": "Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr"}, {"name": "https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa"}, {"name": "https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af"}, {"name": "https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153"}, {"name": "https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944"}], "affected": [{"vendor": "saleor", "product": "saleor", "versions": [{"version": ">= 3.22.0-a.0, < 3.22.29", "status": "affected"}, {"version": ">= 3.21.0-a.0, < 3.21.45", "status": "affected"}, {"version": ">= 3.2.0, < 3.20.110", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-23T23:38:31.414Z"}, "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 could have PIIs exfiltrated. The issue has been patched in Saleor versions: 3.22.29, 3.21.45, and 3.20.110. To workaround, temporarily block non-staff users from fetching order information (the order() GraphQL query) using a WAF."}], "source": {"advisory": "GHSA-r6fj-f4r9-36gr", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24136", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T17:09:35.701674Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:10:01.219Z"}}]}}

{"affected": [{"affectedData": [{"product": "saleor", "vendor": "saleor", "versions": [{"status": "affected", "version": ">= 3.22.0-a.0, < 3.22.29"}, {"status": "affected", "version": ">= 3.21.0-a.0, < 3.21.45"}, {"status": "affected", "version": ">= 3.2.0, < 3.20.110"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D519693-9F38-49CC-A2AA-7A707AE921C4", "versionEndExcluding": "3.20.110", "versionStartIncluding": "3.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD9EA08A-C411-4D72-B4DB-27FAC65202A6", "versionEndExcluding": "3.21.45", "versionStartIncluding": "3.21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "matchCriteriaId": "72EB08B2-3E6B-40B7-AFE2-783A7FDDFAA3", "versionEndExcluding": "3.22.29", "versionStartIncluding": "3.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 could have PIIs exfiltrated. The issue has been patched in Saleor versions: 3.22.29, 3.21.45, and 3.20.110. To workaround, temporarily block non-staff users from fetching order information (the order() GraphQL query) using a WAF."}, {"lang": "es", "value": "Saleor es una plataforma de comercio electr\u00f3nico. Las versiones 3.2.0 a 3.20.109, 3.21.0-a.0 a 3.21.44 y 3.22.0-a.0 a 3.22.28 tienen una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) que permite a actores no autenticados extraer informaci\u00f3n sensible en texto plano. Los pedidos creados antes de Saleor 3.2.0 podr\u00edan haber tenido PIIs exfiltrados. El problema ha sido parcheado en las versiones de Saleor: 3.22.29, 3.21.45 y 3.20.110. Como soluci\u00f3n alternativa, bloquee temporalmente a los usuarios que no son personal de obtener informaci\u00f3n de pedidos (la consulta GraphQL order()) usando un WAF."}], "id": "CVE-2026-24136", "lastModified": "2026-06-17T10:22:41.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24136", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T17:09:35.701674Z", "version": "2.0.3"}}]}, "published": "2026-01-24T00:15:49.167", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6af"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36gr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:02:44.833898+00:00", "value": {"mitigation_remediation": ["Upgrade to the patched Saleor releases: 3.20.110, 3.21.45, or 3.22.29. ", "If a patch cannot be applied immediately, configure your WAF to block non\u2011staff users from accessing the order() GraphQL query. ", "Implement proper authorization checks on the GraphQL order resolvers to ensure only authenticated staff can retrieve order data."], "summary": {"action": "Immediate Patch", "impact": "Sensitive Data Exposure"}, "threat_synthesis": {"affected_systems": "Saleor e\u2011commerce platform, vendors: Saleor, product: Saleor. Affected releases include 3.2.0 through 3.20.109, 3.21.0\u2011a.0 through 3.21.44, and 3.22.0\u2011a.0 through 3.22.28.", "description_and_impact": "This vulnerability is an Insecure Direct Object Reference in Saleor\u2019s GraphQL API that allows an unauthenticated user to retrieve order information, including personally identifiable information created before version\u00a03.2.0. The flaw arises from insufficient authorization checks on the order() GraphQL query, enabling attackers to read sensitive data that should be restricted to authenticated staff accounts.", "risk_and_exploitability": "The CVSS vector indicates a high severity of 8.7. Exploitation probability remains low (EPSS <\u202f1\u202f%) and the vulnerability is not listed in the CISA KEV catalog. Attack opportunity exists through the public GraphQL endpoint without authentication, relying on the IDOR weakness (CWE\u2011639)."}}}}, "created": "2026-01-26T11:48:59.478286+00:00", "updated": "2026-04-18T03:15:35.426300+00:00", "vendors": ["saleor", "saleor$PRODUCT$saleor"]}