CVE-2022-39275

Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the `assignNavigation()` mutation. This issue has been patched in main and backported to multiple releases (3.7.17, 3.6.18, 3.5.23, 3.4.24, 3.3.26, 3.2.14, 3.1.24). Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-863
• CWE-20

• https://github.com/saleor/saleor/commit/96e04c092ddcac17b14f2e31554aa02d9006d0cePatch, Third Party Advisory
• https://github.com/saleor/saleor/security/advisories/GHSA-xhq8-8c5v-w8ffThird Party Advisory
• https://github.com/saleor/saleor/commit/96e04c092ddcac17b14f2e31554aa02d9006d0cePatch, Third Party Advisory
• https://github.com/saleor/saleor/security/advisories/GHSA-xhq8-8c5v-w8ffThird Party Advisory

Published

Oct 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3927 The affected products store both public and private key tha…9.8
• CVE-2022-39270DiscoTOC is a Discourse theme component that generates a tab…5.4
• CVE-2022-39271Traefik (pronounced traffic) is a modern HTTP reverse proxy …7.5
• CVE-2022-39272Flux is an open and extensible continuous delivery solution …4.3
• CVE-2022-39273FlyteAdmin is the control plane for the data processing plat…7.5
• CVE-2022-39274LoRaMac-node is a reference implementation and documentation…9.8
• CVE-2022-39276GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…5.3
• CVE-2022-39277GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…4.8
• CVE-2022-39278Istio is an open platform-independent service mesh that prov…7.5
• CVE-2022-39279discourse-chat is a plugin for the Discourse message board w…5.4
• CVE-2022-3928 Hardcoded credential is found in affected products' message…5.5
• CVE-2022-39280dparse is a parser for Python dependency files. dparse in ve…7.5