CVE-2020-7964 Missing Authentication for Critical Function in Saleor

Medium 5.3 Published 24 Jan 2020 Updated 4 Aug 2024

Attackers can attach checkouts to arbitrary user IDs, leaking sensitive customer data like names and addresses in Saleor.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-7964?

CVE-2020-7964 is a medium-severity missing authorization vulnerability in n/a, published on 24 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

Weakness: CWE-306

Which versions are affected by CVE-2020-7964?

3 open source packages ship an affected version, including saleor. It affects 1 product.

Package	Affected	Fixed in
`saleor` PyPI	From `2.0.0`	`2.9.1`
`saleor` PyPI	From `2.0.0`	`2.9.1`
`saleor` PyPI	From `2.0.0`	`2.9.1`

Products include Mirumee Saleor.

How do I fix CVE-2020-7964?

Upgrade saleor to 2.9.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-7964 being exploited?

There is no known exploitation of CVE-2020-7964 in the wild and no public exploit code.

Sources

Also known as GHSA-rgcm-rpq9-9cgr, PYSEC-2026-747.