CVE-2026-24136

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 could have PIIs exfiltrated. The issue has been patched in Saleor versions: 3.22.29, 3.21.45, and 3.20.110. To workaround, temporarily block non-staff users from fetching order information (the order() GraphQL query) using a WAF.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jan 24, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-241375.8sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (CVE-2026-241387.5FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticate CVE-2026-241396.5MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization b CVE-2026-24149.8Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.CVE-2026-241405.3MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in CVE-2026-241417.8NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe dese CVE-2026-241429.8NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulner CVE-2026-241467.5NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a serv CVE-2026-241474.8NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading CVE-2026-241489.4NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initia CVE-2026-241497.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code inje CVE-2026-24155.9Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email templat