CVE-2024-29036

Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.

• CWE-200

• https://github.com/saleor/auth-sdk/commit/56db13407aa35d00b85ec2df042692edd4aea9daPatch
• https://github.com/saleor/saleor-docs/pull/1120Issue Tracking
• https://github.com/saleor/storefront/commit/579241e75a5eb332ccf26e0bcdd54befa33f4783Patch
• https://github.com/saleor/storefront/security/advisories/GHSA-52cq-c7x7-cqw4Vendor Advisory
• https://github.com/saleor/auth-sdk/commit/56db13407aa35d00b85ec2df042692edd4aea9daPatch
• https://github.com/saleor/saleor-docs/pull/1120Issue Tracking
• https://github.com/saleor/storefront/commit/579241e75a5eb332ccf26e0bcdd54befa33f4783Patch
• https://github.com/saleor/storefront/security/advisories/GHSA-52cq-c7x7-cqw4Vendor Advisory

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29030memos is a privacy-first, lightweight note-taking service. I…5.3
• CVE-2024-29031Meshery is an open source, cloud native manager that enables…7.5
• CVE-2024-29032Qiskit IBM Runtime is an environment that streamlines quantu…7.8
• CVE-2024-29033OAuthenticator provides plugins for JupyterHub to use common…9.1
• CVE-2024-29034CarrierWave is a solution for file uploads for Rails, Sinatr…6.1
• CVE-2024-29035Umbraco is an ASP.NET CMS. Failing webhooks logs are availab…5.3
• CVE-2024-29037datahub-helm provides the Kubernetes Helm charts for deployi…9.1
• CVE-2024-29038tpm2-tools is the source repository for the Trusted Platform…3.3
• CVE-2024-29039tpm2 is the source repository for the Trusted Platform Modul…8.1
• CVE-2024-2904Cross-Site Request Forgery (CSRF) vulnerability in Extend Th…8.8
• CVE-2024-29040This repository hosts source code implementing the Trusted C…4.3
• CVE-2024-29041Express.js minimalist web framework for node. Versions of Ex…6.1