These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-44472 Saleor account activation issue allows attackers to access victim's order history and personal data via email verification exploit. The vulnerability exists in Saleor versions 2.10.0rc1 through 3.21.66, 3.22.62, and 3.23.21, enabling attackers to create an account with a victim's email address and access their order history and personal data if the victim follows the activation link. Defend [truncated]
A broken authorization check in Saleor e-commerce platform versions 3.14.67 until 3.21.67, 3.22.63, and 3.23.22 allows unauthenticated GraphQL requests to modify channel settings and expose hidden objects. This issue permits anonymous callers to use the channelUpdate() mutation to change channel order settings such as allowUnpaidOrders even when the response reports PermissionDenied. The same permission u [truncated]
The Saleor e-commerce platform has a vulnerability in its requestEmailChange mutation. From version 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the mutation reveals the existence of user-provided email addresses in error messages. This issue has been fixed in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118. The vulnerability can be exploited by attackers to gather information about valid [truncated]