CVE-2026-24136CWE-639

Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

High · published January 23, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 could have PIIs exfiltrated. The issue has been patched in Saleor versions: 3.22.29, 3.21.45, and 3.20.110. To workaround, temporarily block non-staff users from fetching order information (the order() GraphQL query) using a WAF.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-01-23T23:38Z
EPSS history
Timeline
  • 23 JAN 23:38Z
    Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
    cvelistv5