CVE-2025-58442: Saleor Information Disclosure Flaw

CVE-2025-58442 Overview

CVE-2025-58442 is an information disclosure vulnerability in Saleor, an open-source headless e-commerce platform built with Python, GraphQL, and Django. Versions 3.21.0 through 3.21.15 allow attackers to enumerate registered user accounts by inspecting responses to the accountRegister GraphQL mutation. Requesting specific fields in the response can trigger errors that reveal whether an account with a given email address already exists. The issue is categorized as an observable response discrepancy [CWE-204]. Saleor version 3.21.16 addresses the flaw, and administrators unable to upgrade immediately can rate-limit the mutation as a temporary control.

Critical Impact
Unauthenticated attackers can enumerate valid user email addresses in a Saleor storefront, enabling targeted phishing, credential stuffing, and reconnaissance for follow-on attacks.

Affected Products

Saleor 3.21.0 through 3.21.15
Deployments exposing the accountRegister GraphQL mutation
Storefronts built on affected Saleor backend versions

Discovery Timeline

2025-09-09 - CVE-2025-58442 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58442

Vulnerability Analysis

Saleor exposes an accountRegister GraphQL mutation that customers use to create new accounts. The mutation response includes a user object with fields such as the account identifier. When a client requests certain fields in the response for an email that already belongs to an existing user, the GraphQL resolver returns an error or response structure that differs from the response returned for a new email. This observable discrepancy allows an attacker to distinguish between existing and non-existing accounts without authentication.

The vulnerability does not expose passwords, tokens, or personal data. It leaks account existence, which supports reconnaissance workflows for account takeover campaigns and targeted phishing.

Root Cause

The root cause is the response construction logic in saleor/graphql/account/mutations/account/account_register.py. The mutation attempted to suppress the returned user identifier for existing accounts by toggling a RETURN_ID_IN_API_RESPONSE attribute on the user model. This approach was fragile — requesting other resolvable fields on the user object still exposed differential behavior between existing and newly created accounts.

Attack Vector

An unauthenticated attacker sends accountRegister mutations against the public GraphQL endpoint with candidate email addresses. By requesting specific subfields on the returned user object, the attacker observes response differences that indicate whether the email is already registered. Automation makes bulk enumeration trivial against unrate-limited endpoints.

python

# Vulnerable logic (before patch) in account_register.py
# we don't want to return id's as it will allow to deduce if user exists
if response.user:
    response.user.RETURN_ID_IN_API_RESPONSE = False
return response

# Patched logic (3.21.16)
if response.user:
    response.user.NEWLY_CREATED_USER = True
return response

Source: Saleor commit b357838

The fix replaces the RETURN_ID_IN_API_RESPONSE flag on the User model with a NEWLY_CREATED_USER flag, changing how resolvers determine which fields are safe to return for the current mutation context and eliminating the observable discrepancy.

Detection Methods for CVE-2025-58442

Indicators of Compromise

High-volume accountRegister GraphQL mutations originating from a single IP or narrow IP range within a short window.
Repeated accountRegister requests that iterate through email addresses in dictionary or breach-list patterns.
GraphQL requests that specifically select uncommon subfields on the user object returned by accountRegister.

Detection Strategies

Parse GraphQL request bodies at the reverse proxy or API gateway and count unique email values submitted to accountRegister per source IP.
Correlate spikes in accountRegister traffic with subsequent authentication attempts or password-reset requests against the same email set.
Alert on response-size or response-shape variance for accountRegister when serving from vulnerable Saleor versions.

Monitoring Recommendations

Log the full GraphQL operation name and selected fields for every accountRegister call at the application layer.
Track Saleor server version in asset inventory and flag any instance running a version below 3.21.16.
Monitor Web Application Firewall (WAF) telemetry for enumeration patterns targeting registration endpoints.

How to Mitigate CVE-2025-58442

Immediate Actions Required

Upgrade Saleor to version 3.21.16 or later on all environments running 3.21.0 through 3.21.15.
Apply rate limiting to the accountRegister mutation at the API gateway or WAF until the patch is deployed.
Review authentication and password-reset logs for enumeration activity preceding the upgrade.

Patch Information

The fix is published in Saleor 3.21.16. The relevant commits change the User model flag from RETURN_ID_IN_API_RESPONSE to NEWLY_CREATED_USER and adjust the accountRegister resolver accordingly. See the GitHub Security Advisory GHSA-8w67-mfm5-fwx5 and the 3.21.16 release notes for full details.

Workarounds

Enforce strict rate limits on the accountRegister mutation per source IP and per API key.
Deploy a WAF rule that blocks or challenges high-frequency GraphQL requests targeting accountRegister.
Require CAPTCHA or proof-of-work challenges on the registration flow to slow automated enumeration.

bash

# Example: upgrade Saleor via Poetry
poetry add saleor@3.21.16

# Example: NGINX rate limit for the GraphQL endpoint
limit_req_zone $binary_remote_addr zone=graphql_reg:10m rate=5r/m;

location /graphql/ {
    limit_req zone=graphql_reg burst=10 nodelay;
    proxy_pass http://saleor_backend;
}