CVE-2025-58442 Saleor has user enumeration vulnerability due to different error messages
Attackers can enumerate valid user emails by observing distinct error messages during account registration in Saleor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-58442?
CVE-2025-58442 is a medium-severity vulnerability in saleor, published on 9 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact.
Weakness: CWE-204
Which versions are affected by CVE-2025-58442?
How do I fix CVE-2025-58442?
No fix has been published for CVE-2025-58442 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-58442 being exploited?
There is no known exploitation of CVE-2025-58442 in the wild and no public exploit code.
Sources
Also known as GHSA-8w67-mfm5-fwx5.