CVE-2023-26051

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
saleor	saleor	>= 2.0.0, < 3.1.48; >= 3.11.0, < 3.11.12; >= 3.10.0, < 3.10.14; >= 3.9.0, < 3.9.27; >= 3.8.0, < 3.8.30; >= 3.7.0, < 3.7.59

References

https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1Patch
https://github.com/saleor/saleor/releases/tag/3.1.48Release Notes
https://github.com/saleor/saleor/releases/tag/3.10.14Release Notes
https://github.com/saleor/saleor/releases/tag/3.11.12Release Notes
https://github.com/saleor/saleor/releases/tag/3.7.59Release Notes
https://github.com/saleor/saleor/releases/tag/3.8.30Release Notes
https://github.com/saleor/saleor/releases/tag/3.9.27Release Notes
https://github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85Vendor Advisory
https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1Patch
https://github.com/saleor/saleor/releases/tag/3.1.48Release Notes
https://github.com/saleor/saleor/releases/tag/3.10.14Release Notes
https://github.com/saleor/saleor/releases/tag/3.11.12Release Notes
https://github.com/saleor/saleor/releases/tag/3.7.59Release Notes
https://github.com/saleor/saleor/releases/tag/3.8.30Release Notes
https://github.com/saleor/saleor/releases/tag/3.9.27Release Notes
https://github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85Vendor Advisory

Timeline

Published: Mar 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-260525.3Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handle CVE-2023-260539.8Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (CVE-2023-260546.5BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions CVE-2023-260559.9XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can ed CVE-2023-260565.4XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another CVE-2023-260576.5An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a CVE-2023-260586.5An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a prope CVE-2023-260595.4An issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when pr CVE-2023-26064.8The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-260608.8An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that h CVE-2023-260615.4An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can crea CVE-2023-260627.8A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user ca