CVE-2026-39851 Saleor has a user enumeration vulnerability due to different error messages
Attackers can enumerate valid user email addresses via distinct error messages in the requestEmailChange mutation, exposing user data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39851?
CVE-2026-39851 is a medium-severity vulnerability in saleor, published on 8 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Weakness: CWE-204
Which versions are affected by CVE-2026-39851?
It affects 1 product.
Products include Saleor Saleor.
How do I fix CVE-2026-39851?
No fix has been published for CVE-2026-39851 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-39851 being exploited?
There is no known exploitation of CVE-2026-39851 in the wild and no public exploit code.
Other vulnerabilities in saleor
- CVE-2026-24136 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
- CVE-2026-23499 Saleor vulnerable to stored XSS via Unrestricted File Upload
- CVE-2026-33756 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
- CVE-2026-35401 Saleor has a resource exhaustion vulnerability in GraphQL queries
- CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields
Sources
Also known as GHSA-m3rm-m4vq-27x7.