CVE-2026-35407 Saleor has Cross-Account Email Change via Unbound Confirmation Token

What is CVE-2026-35407?

CVE-2026-35407 is a medium-severity vulnerability in saleor, published on 8 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticated user. As a result, a valid email-change token generated for one account can be replayed while authenticated as a different account. The second account’s email address is then updated to the token's new_email, even though that token was never issued for that account. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Weakness: CWE-285

Which versions are affected by CVE-2026-35407?

It affects 1 product.

Products include Saleor Saleor.

How do I fix CVE-2026-35407?

No fix has been published for CVE-2026-35407 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-35407 being exploited?

There is no known exploitation of CVE-2026-35407 in the wild and no public exploit code.

Other vulnerabilities in saleor

• CVE-2026-24136 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API High 8.7
• CVE-2026-23499 Saleor vulnerable to stored XSS via Unrestricted File Upload High 8.5
• CVE-2026-33756 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching High 7.5
• CVE-2026-35401 Saleor has a resource exhaustion vulnerability in GraphQL queries High 7.5
• CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hwph-9537-mc3p.