CVE-2024-29888: Saleor E-Commerce Address Disclosure Flaw

CVE-2024-29888 Overview

CVE-2024-29888 is an information exposure vulnerability in Saleor, an open-source e-commerce platform used by high-volume commerce companies. When a customer selects the Pickup: Local stock only click-and-collect delivery method, specific conditions allow the customer's checkout to overwrite the warehouse address with the customer's own address. The result exposes the customer's personal address as the click-and-collect (warehouse) shipping address associated with the order.

The issue is categorized under [CWE-359] Exposure of Private Personal Information to an Unauthorized Actor. Saleor has patched the flaw in versions 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, and 3.19.15.

Critical Impact
Customer personal address data can be persistently written into warehouse-linked order shipping addresses, leaking personally identifiable information (PII) through the click-and-collect flow.

Affected Products

Saleor versions prior to 3.14.61 in the 3.14.x branch
Saleor versions prior to 3.15.37, 3.16.34, 3.17.32, and 3.18.28
Saleor versions prior to 3.19.15 in the 3.19.x branch

Discovery Timeline

2024-03-27 - CVE-2024-29888 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-29888

Vulnerability Analysis

Saleor's checkout flow allows customers to choose a delivery method, including click-and-collect at a specific warehouse. During checkout completion, the platform links the order's shipping_address to the selected warehouse's address record. Under specific conditions in the affected versions, the checkout logic mutated the warehouse's shared address object rather than cloning it. The consequence: a customer's submitted address data could overwrite the warehouse address, and subsequent orders referencing that warehouse would surface the leaked customer address.

The root exposure is PII disclosure. The vulnerability requires user interaction during checkout and does not impact availability, but it undermines confidentiality and integrity of stored address data.

Root Cause

The defect resides in saleor/checkout/complete_checkout.py and the checkout_delivery_method_update GraphQL mutation. When delivery_method_info.warehouse_pk was set, the checkout code reused the referenced warehouse Address object directly instead of creating an independent copy. Because the same Address row was shared between the Warehouse model and the Order.shipping_address foreign key, any write path that persisted the customer-supplied address to shipping_address also modified the warehouse's canonical address.

Attack Vector

An attacker (or ordinary customer) begins a checkout, selects a Pickup: Local stock only click-and-collect warehouse as the delivery method, and progresses through the checkout with an attacker-controlled address. Under the vulnerable code path, the customer address overwrites the shared warehouse address record. Later customers using the same warehouse for click-and-collect receive the previously injected address in their order shipping data, exposing PII across tenants of the shared warehouse.

python

# Patch: saleor/checkout/complete_checkout.py
# Fix relation between order and click and collect address (#15697)
        if checkout_info.user.addresses.filter(pk=shipping_address.pk).exists():
            shipping_address = shipping_address.get_copy()

+   if shipping_address and delivery_method_info.warehouse_pk:
+       shipping_address = shipping_address.get_copy()
+
    shipping_method = delivery_method_info.delivery_method
    tax_class = getattr(shipping_method, "tax_class", None)

Source: Saleor commit 47cedfd7. The fix forces get_copy() on the shipping address whenever a warehouse-backed click-and-collect delivery method is selected, isolating the order's address from the warehouse's canonical address record.

A companion patch introduces the SHIPPING_CHANGE_FORBIDDEN error code in saleor/checkout/error_codes.py and enforces stricter validation in the checkout_delivery_method_update mutation against WarehouseClickAndCollectOption. See Saleor commit 22a1aa3 and Saleor commit 39abb0f4.

Detection Methods for CVE-2024-29888

Indicators of Compromise

Warehouse Address records whose fields (street, city, postal code, name) no longer match operator-provisioned warehouse data.
Orders on multiple customer accounts showing identical shipping addresses tied to the same click-and-collect warehouse.
Audit-log or database-modification events on the warehouse_warehouse and account_address tables originating from checkout GraphQL requests.

Detection Strategies

Compare current warehouse addresses against a known-good baseline exported before deploying vulnerable versions. Any drift on Address rows linked to warehouses is a strong signal.
Review GraphQL API telemetry for checkoutDeliveryMethodUpdate and checkoutComplete mutations that reference Warehouse IDs and precede warehouse address changes.
Inspect the Order.shipping_address_id foreign key: prior to the patch, click-and-collect orders share the warehouse's address row. Patched deployments create per-order copies.

Monitoring Recommendations

Enable database-level audit logging on the account_address and warehouse_warehouse tables to capture unexpected mutations.
Forward Saleor application logs and GraphQL access logs to a centralized SIEM or data lake for correlation across checkout events and administrative changes.
Alert on any customer-account activity that immediately precedes a change in warehouse address fields.

How to Mitigate CVE-2024-29888

Immediate Actions Required

Upgrade Saleor to a patched release: 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, or 3.19.15.
Export current warehouse address records and reconcile them against operator source-of-truth data. Restore any warehouse addresses altered by prior checkouts.
Notify affected customers if PII exposure is confirmed, in line with applicable privacy regulations.

Patch Information

The fix ships across multiple commits on the Saleor repository. Primary fixes: Saleor commit 47cedfd7 (address relationship fix), Saleor commit 22a1aa3, and Saleor commit 39abb0f4 (tax calculation and forbidden shipping change enforcement). A data migration in saleor/order/migrations/0172_update_order_cc_addresses.py rewrites existing click-and-collect orders to hold their own Address copies. Full context is available in the GitHub Security Advisory GHSA-mrj3-f2h4-7w45, Pull Request #15694, and Pull Request #15697.

Workarounds

Disable the Pickup: Local stock only click-and-collect option on all warehouses until upgrade is complete.
Remove or restrict permissions on the checkoutDeliveryMethodUpdate mutation for anonymous checkouts if disabling click-and-collect is not feasible.
Periodically re-sync warehouse addresses from a trusted operator source to overwrite any customer-injected data.

bash

# Upgrade Saleor to a patched release (example for the 3.19 branch)
pip install --upgrade 'saleor==3.19.15'

# Run the migration that rebases click-and-collect orders onto their own address copies
python manage.py migrate order 0172_update_order_cc_addresses