CVE-2023-26052

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.

• CWE-209
• CWE-209

• https://github.com/saleor/saleor/releases/tag/3.1.48Release Notes
• https://github.com/saleor/saleor/releases/tag/3.10.14Release Notes
• https://github.com/saleor/saleor/releases/tag/3.11.12Release Notes
• https://github.com/saleor/saleor/releases/tag/3.7.59Release Notes
• https://github.com/saleor/saleor/releases/tag/3.8.30Release Notes
• https://github.com/saleor/saleor/releases/tag/3.9.27Release Notes
• https://github.com/saleor/saleor/security/advisories/GHSA-3hvj-3cg9-v242Vendor Advisory
• https://github.com/saleor/saleor/releases/tag/3.1.48Release Notes
• https://github.com/saleor/saleor/releases/tag/3.10.14Release Notes
• https://github.com/saleor/saleor/releases/tag/3.11.12Release Notes
• https://github.com/saleor/saleor/releases/tag/3.7.59Release Notes
• https://github.com/saleor/saleor/releases/tag/3.8.30Release Notes
• https://github.com/saleor/saleor/releases/tag/3.9.27Release Notes
• https://github.com/saleor/saleor/security/advisories/GHSA-3hvj-3cg9-v242Vendor Advisory

Published

Mar 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26046teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26047teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26048Jetty is a java based web server and servlet engine. In affe…5.3
• CVE-2023-26049Jetty is a java based web server and servlet engine. Nonstan…5.3
• CVE-2023-2605The wpbrutalai WordPress plugin before 2.0.1 does not saniti…6.1
• CVE-2023-26051Saleor is a headless, GraphQL commerce platform delivering p…4.3
• CVE-2023-26053Gradle is a build tool with a focus on build automation and …9.8
• CVE-2023-26054BuildKit is a toolkit for converting source code to build ar…6.5
• CVE-2023-26055XWiki Commons are technical libraries common to several othe…9.9
• CVE-2023-26056XWiki Platform is a generic wiki platform. Starting in versi…5.4
• CVE-2023-26057An XXE issue was discovered in Nokia NetAct before 22 FP2211…6.5
• CVE-2023-26058An XXE issue was discovered in Nokia NetAct before 22 FP2211…6.5