Description

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate() mutation to change channel order settings such as allowUnpaidOrders even when the response reports PermissionDenied. The same permission utility can expose hidden objects through the pageType() and translation() queries, including attributes whose visibleInStorefront field is false and that should be visible only to users with management permissions. This issue is fixed in versions 3.21.67, 3.22.63, and 3.23.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T17:16:57.533Z",
  "pubdate": "2026-08-18T17:16:57.533Z",
  "executiveSummary": "A broken authorization vulnerability has been identified in the Saleor e-commerce platform, specifically residing within the permission utility logic. This security flaw allows unauthenticated and anonymous callers to incorrectly bypass permission boundaries when executing specific GraphQL operations, despite receiving a PermissionDenied error response.\nThe vulnerability impacts the Saleor platform across versions from 3.14.67 up to, but excluding, 3.21.67, 3.22.63, and 3.23.22. The primary risk implication involves unauthorized modification of core e-commerce settings and unauthorized data exposure. Attackers possessing unauthenticated capabilities can leverage this flaw to alter critical channel configurations, such as the allowUnpaidOrders parameter via the channelUpdate() mutation, and extract sensitive hidden objects through the pageType() and translation() queries, including restricted attributes marked with visibleInStorefront set to false that are strictly intended for users with management privileges.\nNo complex exploitation requirements or prior authentication are needed to trigger the flaw, lowering the barrier for external threat actors to compromise confidentiality and integrity boundaries within the affected e-commerce infrastructure.",
  "technicalDetails": "The root cause of the vulnerability stems from a broken authorization check implemented within the vulnerable file saleor/permission/utils.py. Due to flawed permission validation logic, the application fails to properly enforce access controls during the execution lifecycle of certain GraphQL requests.\nThe vulnerable components involve specific API endpoints handling the channelUpdate() mutation, as well as the pageType() and translation() queries. Although the system may superficially report a PermissionDenied response to the client, the underlying permission utility flaw permits the unintended execution of state-changing operations or the retrieval of restricted data payloads.\nThe exploitation method begins with network exposure of the GraphQL interface. An unauthenticated attacker crafts malicious requests targeting the channelUpdate() mutation. By exploiting the flawed authorization check in saleor/permission/utils.py, the attacker successfully modifies sensitive channel order settings, such as toggling the allowUnpaidOrders configuration, bypassing the intended authorization checks entirely.\nAdditionally, the same broken authorization utility can be weaponized to query restricted metadata. Attackers can issue specially crafted requests using the pageType() and translation() queries to enumerate and extract hidden objects. This includes sensitive attributes where the visibleInStorefront field is explicitly configured as false, exposing internal data structures that should exclusively be accessible to authenticated users possessing elevated management permissions.\nThe affected versions encompass Saleor releases starting from version 3.14.67 up to versions prior to 3.21.67, 3.22.63, and 3.23.22. The attack requires zero authentication credentials and no special privileges, operating purely over network access to the GraphQL API. The post-exploitation impact includes unauthorized modification of e-commerce business logic settings and the leakage of sensitive management-tier information."
}