CVE-2026-39851 saleor CVE debrief

Who should care

Users of Saleor e-commerce platform versions 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118 should be aware of this vulnerability and take necessary actions to protect their systems. This includes administrators, security teams, and operators who manage or use the Saleor e-commerce platform. They should review the official CVE record and assess their environment for potential exposure.

Technical summary

The requestEmailChange mutation in Saleor e-commerce platform versions 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118 reveals the existence of user-provided email addresses in error messages. This vulnerability can be exploited by attackers to gather information about valid email addresses associated with user accounts. The vulnerability is due to inadequate error handling in the mutation, allowing attackers to determine whether an email address is associated with a user account. To mitigate this vulnerability, users should update the Saleor e-commerce platform to version 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118, or later.

Defensive priority

Medium

Recommended defensive actions

• Update Saleor e-commerce platform to version 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118, or later
• Implement additional monitoring and logging to detect potential exploitation attempts
• Review and update email address validation and error handling mechanisms
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T19:25:26.620Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The Saleor e-commerce platform versions 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118 have a vulnerability in the requestEmailChange mutation. This vulnerability reveals the existence of user-provided email addresses in error messages. To verify, defenders should review the official CVE record and assess their environment for potential exposure.

Official resources