Back to Database
Status published
Medium
CVE-2023-26051
Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions
Vulnerability Description
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-26051
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85
- https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1
- https://github.com/saleor/saleor/releases/tag/3.1.48
- https://github.com/saleor/saleor/releases/tag/3.10.14
- https://github.com/saleor/saleor/releases/tag/3.11.12
- https://github.com/saleor/saleor/releases/tag/3.7.59
- https://github.com/saleor/saleor/releases/tag/3.8.30
- https://github.com/saleor/saleor/releases/tag/3.9.27
More from saleor
View All →CVE-2025-58442
Saleor has user enumeration vulnerability due to different error messages
Medium
5.3
CVE-2024-31205
Saleor CSRF bypass in refreshToken mutation
Medium
4.2
CVE-2024-29888
Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method
Medium
4.2
CVE-2024-29036
Saleor Storefront session leak in cache
Medium
4.3
CVE-2023-3294
Cross-site Scripting (XSS) - DOM in saleor/react-storefront
High
7.6
Affected Vendor
saleor
View all reports →Affected Software
saleor
Vulnerable Versions:
>= 2.0.0, < 3.1.48, >= 3.11.0, < 3.11.12, >= 3.10.0, < 3.10.14, >= 3.9.0, < 3.9.27, >= 3.8.0, < 3.8.30, >= 3.7.0, < 3.7.59
Timeline
Official Publish:
March 2nd, 2023
Last Modified:
March 5th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N