CVE-2026-35407
Last modified
CVE-2026-35407 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's new_email, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Saleor | Saleor | >= 2.10.0, < 3.20.118 |
| Saleor | Saleor | >= 3.20.119, < 3.21.54 |
| Saleor | Saleor | >= 3.22.0, < 3.22.47 |
| Saleor | Saleor | 3.23.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-35407?
How severe is CVE-2026-35407?
How do I fix CVE-2026-35407?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-35401Saleor is an e-commerce platform. From 2.0.0 to before 3.23.…7.5
- CVE-2026-35402mcp-neo4j-cypher is an MCP server for executing Cypher queri…2.3
- CVE-2026-35403LORIS (Longitudinal Online Research and Imaging System) is a…5.4
- CVE-2026-35404Open edX Platform enables the authoring and delivery of onli…6.1
- CVE-2026-35405libp2p-rust is the official rust language Implementation of …7.5
- CVE-2026-35406Aardvark-dns is an authoritative dns server for A/AAAA conta…7.5
- CVE-2026-35408Directus is a real-time API and App dashboard for managing S…9.3
- CVE-2026-35409Directus is a real-time API and App dashboard for managing S…7.7
- CVE-2026-3541Inappropriate implementation in CSS in Google Chrome prior t…8.8
- CVE-2026-35410Directus is a real-time API and App dashboard for managing S…6.1
- CVE-2026-35411Directus is a real-time API and App dashboard for managing S…4.3
- CVE-2026-35412Directus is a real-time API and App dashboard for managing S…8.1
Are you affected by CVE-2026-35407?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST