CVE-2026-35407
Saleor has Cross-Account Email Change via Unbound Confirmation Token
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's new_email, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 4.0 | Medium5.9 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CISA-ADPADP (enrichment) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVDNVD · Analyzed | 4.0 | Medium5.9 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.30% · top 77% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Weakness
Affected products
References (6)
- https://github.com/saleor/saleor/security/advisories/GHSA-hwph-9537-mc3p (opens in a new tab)x_refsource_CONFIRM
- https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64 (opens in a new tab)x_refsource_MISC
- https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8 (opens in a new tab)x_refsource_MISC
- https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a (opens in a new tab)x_refsource_MISC
- https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa (opens in a new tab)x_refsource_MISC
- https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-35407)Record last updated .