Description

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use accountRegister to create an account with a victim's email address before the victim registers. If the victim follows the activation link sent to that mailbox, Saleor activates the attacker-created account and saleor/graphql/account/mutations/account/confirm_account.py can merge anonymous orders and gift-card data for the same email address without requiring the account password or another authentication factor. The attacker can then access the merged order history and personal data, including names, addresses, and phone numbers. The patched supported lines disable automatic merging by default, while the redesigned 3.24.0 flow requires password confirmation before anonymous objects are linked. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T18:17:33.573Z",
  "pubdate": "2026-08-18T18:17:33.573Z",
  "executiveSummary": "A logic vulnerability exists in the account activation flow of Saleor affecting versions 2.10.0rc1 through 3.21.67, 3.22.63, and 3.23.22. The vulnerability arises because the platform treats email verification as sufficient proof of account ownership during activation and automatically associates anonymous commerce data with newly activated accounts.\nAn unauthenticated attacker can leverage the accountRegister mutation to pre-register an account using a victim's email address. If the victim subsequently interacts with the activation link sent to their mailbox, Saleor activates the attacker-controlled account.\nThis flaw allows saleor/graphql/account/mutations/account/confirm_account.py to automatically merge anonymous orders and gift-card data belonging to the same email address without requiring the account password or any secondary authentication factor.\nThe risk implications include unauthorized access to sensitive personal data, including names, physical addresses, phone numbers, and comprehensive order histories. Successful exploitation requires the attacker to know or target the victim's email address and induce the victim to complete the activation process initiated by the attacker.",
  "technicalDetails": "The vulnerability stems from improper trust assumptions within the account activation and data association logic. Specifically, the vulnerable component is located in saleor/graphql/account/mutations/account/confirm_account.py, which processes account confirmation tokens and manages post-activation data synchronization.\nThe attack flow proceeds as follows: First, an unauthenticated attacker invokes the accountRegister GraphQL mutation using a target victim's email address. This action creates a dormant user record in the database and triggers an email verification message containing an activation token sent to the specified mailbox.\nSecond, the victim receives the activation link and follows it to complete the registration process, believing it corresponds to their own legitimate intent to register. When the activation request is processed, Saleor marks the account as active.\nThird, because the system treats email verification as absolute proof of ownership without enforcing secondary authentication factors such as the account password, the backend logic automatically links existing anonymous commerce data—such as orders and gift cards associated with that email address—to the newly activated account.\nBecause the attacker initiated the account creation process, they retain access credentials or control over the newly activated account, thereby gaining unauthorized access to the merged order history and associated Personally Identifiable Information (PII) including names, physical addresses, and phone numbers.\nNetwork exposure includes the public-facing GraphQL API endpoints utilized for account registration and confirmation. Authentication requirements for triggering the initial registration are absent, while activation relies solely on possession of the email verification token. Privilege requirements are nonexistent for the initial attacker, as exploitation targets the trust boundary between email verification and account ownership verification."
}