Saleor vulnerabilities
We track 4 vulnerabilities in Saleor products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 18, 2026.
Latest Saleor vulnerabilities
- 8.1 High severity
saleor: Improper Authentication
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated a
- 7.5 High severity
saleor: Allocation of Resources Without Limits or Throttling
Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion
- 7.5 High severity
saleor: Allocation of Resources Without Limits or Throttling
Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the numbe
- 7.5 High severity
saleor: Authorization Bypass Through User-Controlled Key
Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in p