CVE-2023-26051: Saleor Staff-Authenticated Error Message Information Disclosure Vulnerability

saleor Updated 07 Jul 2026

Summary

07/07/2026

Disclosed on

CVE-2023-26051

CVE

Yes i

Fix available

Moderate

Severity

6.5

CVSS Score

CVE-2023-26051: Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions. Affects saleor across 6 version ranges.

>= 2.0.0, < 3.1.48 >= 3.7.0, < 3.7.59 >= 3.8.0, < 3.8.30 >= 3.9.0, < 3.9.27 >= 3.10.0, < 3.10.14 >= 3.11.0, < 3.11.12

Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Saleor is an open-source e-commerce solution built using Python and Django, designed to provide a flexible and customizable platform for online stores. It offers features such as product management, order processing, and customer engagement tools. However, Saleor has a vulnerability that allows sensitive information to be disclosed through unhandled Python exceptions in staff-authenticated requests.

Vulnerability Detail

The vulnerability arises from the improper handling of certain internal Python exceptions, which can lead to sensitive information being returned in API error messages. Specifically, these messages may inadvertently expose user email addresses when staff members make authenticated requests. This could potentially allow unauthorized access to sensitive user data, posing a significant security risk.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 2.0.0, < 3.1.48 3.1.48
```
pip install --upgrade "saleor==3.1.48"
```
>= 3.7.0, < 3.7.59 3.7.59
```
pip install --upgrade "saleor==3.7.59"
```
>= 3.8.0, < 3.8.30 3.8.30
```
pip install --upgrade "saleor==3.8.30"
```
>= 3.9.0, < 3.9.27 3.9.27
```
pip install --upgrade "saleor==3.9.27"
```
>= 3.10.0, < 3.10.14 3.10.14
```
pip install --upgrade "saleor==3.10.14"
```
>= 3.11.0, < 3.11.12 3.11.12
```
pip install --upgrade "saleor==3.11.12"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There are no workarounds available for this vulnerability. It is recommended to update to a patched version as soon as possible.

Conclusion

The Saleor package has a significant vulnerability that can lead to the disclosure of sensitive information through unhandled exceptions in API error messages. It is essential to update to the latest patched versions to mitigate this risk and protect user data.

See every vulnerability recorded for saleor →

References

Related vulnerabilities

Recent vulnerabilities recorded for saleor.

View all saleor vulnerabilities →

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 2.0.0, < 3.1.48 3.1.48
```
pip install --upgrade "saleor==3.1.48"
```
>= 3.7.0, < 3.7.59 3.7.59
```
pip install --upgrade "saleor==3.7.59"
```
>= 3.8.0, < 3.8.30 3.8.30
```
pip install --upgrade "saleor==3.8.30"
```
>= 3.9.0, < 3.9.27 3.9.27
```
pip install --upgrade "saleor==3.9.27"
```
>= 3.10.0, < 3.10.14 3.10.14
```
pip install --upgrade "saleor==3.10.14"
```
>= 3.11.0, < 3.11.12 3.11.12
```
pip install --upgrade "saleor==3.11.12"
```