saleor
A modular, high performance e-commerce storefront built with GraphQL, Django, and ReactJS.
Activity
- Latest release
- 6y ago
- Total releases
- 1
- Cadence
- —
- Last 12 months
- 0
Details
- License
- BSD-3-Clause
- First release
- Jul 09, 2020
| Version | Released | |
|---|---|---|
2.10.1
initial
3 CVEs
CVE-2023-26051
PYSEC-2026-917
GHSA-r8qr-wwg3-2r85
Jul 07, 2026
Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactSome internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14 and 3.11.12. WorkaroundsNone For more informationIf you have any questions or comments about this advisory:
Affected versions
2.10.1
Fixed in
3.1.48
3.7.59
3.8.30
3.9.27
3.10.14
3.11.12
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-26052
PYSEC-2026-915
GHSA-3hvj-3cg9-v242
Jul 07, 2026
Saleor Unauthenticated Information Disclosure Vulnerability via Python Exceptions
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactSome internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. Affected versions: Saleor ≥ 2.0.0 WorkaroundsNone For more informationIf you have any questions or comments about this advisory:
Affected versions
2.10.1
Fixed in
3.1.48
3.7.59
3.8.30
3.9.27
3.10.14
3.11.12
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2022-0932
PYSEC-2026-746
GHSA-mcgw-5fhw-3fq8
Jul 02, 2026
saleor Missing Authorization vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Missing Authorization in saleor prior to 3.1.2. Affected versions
2.10.1
Fixed in
3.1.2
References
Updated Jul 06, 2026 · Source: OSV.dev |