CVE-2026-39851
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Saleor, an e-commerce platform, from version 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, has a vulnerability in the requestEmailChange() mutation that revealed the existence of user-provided email addresses in error messages. This is fixed in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Risk Assessment
The risk involves user enumeration by checking if an email address exists in the system, which can be used for phishing or brute-force attacks.
Recommendation
Update Saleor to one of the patched versions: 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118.
Original NVD description (English source)
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.