CVE-2026-39851

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

• CWE-204

• https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64Patch
• https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8Patch
• https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2aPatch
• https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43faPatch
• https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-m3rm-m4vq-27x7Patch, Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39846SiYuan is a personal knowledge management system. Prior to 3…9
• CVE-2026-39847Emmett is a full-stack Python web framework designed with si…7.5
• CVE-2026-39848Dockyard is a Docker container management app. Prior to 1.1.…5.4
• CVE-2026-39849Pi-hole FTL is the core engine of the Pi-hole network-level …8.8
• CVE-2026-3985The Creative Mail – Easier WordPress & WooCommerce Email Mar…7.5
• CVE-2026-39850Yii 2 is a PHP application framework. Versions 2.0.54 and pr…7.4
• CVE-2026-39852Quarkus is a Java framework for building cloud-native applic…8.2
• CVE-2026-39853osslsigncode is a tool that implements Authenticode signing …7.8
• CVE-2026-39855osslsigncode is a tool that implements Authenticode signing …5.5
• CVE-2026-39856osslsigncode is a tool that implements Authenticode signing …5.5
• CVE-2026-39857ApostropheCMS is an open-source Node.js content management s…5.3
• CVE-2026-39858Traefik is an HTTP reverse proxy and load balancer. Prior to…10