CVE-2026-24136: Saleor E-Commerce IDOR Vulnerability

CVE-2026-24136 Overview

CVE-2026-24136 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in Saleor, a popular open-source e-commerce platform. This vulnerability allows unauthenticated actors to extract sensitive information in plain text by exploiting inadequate access controls in the GraphQL API. The flaw affects multiple version branches of Saleor and poses a significant risk to customer personally identifiable information (PII) stored in order records.

Critical Impact

Unauthenticated attackers can exfiltrate sensitive customer PII including order details from Saleor e-commerce installations without any authentication, potentially exposing customer data from orders created before version 3.2.0.

Affected Products

• Saleor versions 3.2.0 through 3.20.109
• Saleor versions 3.21.0-a.0 through 3.21.44
• Saleor versions 3.22.0-a.0 through 3.22.28

Discovery Timeline

• January 24, 2026 - CVE-2026-24136 published to NVD
• January 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24136

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). The flaw exists in how Saleor handles authorization checks for the order() GraphQL query endpoint. The platform fails to properly verify that the requesting user has legitimate access to the order information being requested, allowing any unauthenticated actor to query arbitrary order data.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring any prior authentication or special privileges. No user interaction is needed for successful exploitation, making this vulnerability particularly dangerous for publicly-accessible Saleor deployments.

Root Cause

The root cause of this vulnerability lies in missing or inadequate authorization checks within Saleor's GraphQL API layer. Specifically, the order() query does not properly validate whether the requesting user is authorized to access the specific order being queried. This allows attackers to enumerate and retrieve order records by manipulating object identifiers, bypassing the intended access control mechanisms.

Orders created prior to Saleor version 3.2.0 are particularly vulnerable as they may contain PII that was stored without the protections introduced in later versions.

Attack Vector

The attack leverages Saleor's GraphQL API, which is accessible over the network. An attacker can craft malicious GraphQL queries targeting the order() endpoint, supplying arbitrary order identifiers to retrieve sensitive information. The attack flow typically involves:

1. Identifying a Saleor e-commerce installation with an exposed GraphQL endpoint
2. Crafting GraphQL queries targeting the order() query with enumerated or guessed order identifiers
3. Extracting sensitive customer PII including names, addresses, contact information, and order details in plain text
4. Repeating the process to exfiltrate data from multiple orders

Since no authentication is required, attackers can automate this process to systematically extract large volumes of customer data. For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-r6fj-f4r9-36gr.

Detection Methods for CVE-2026-24136

Indicators of Compromise

• Unusually high volume of GraphQL order() queries from unauthenticated sources
• Sequential or enumerated order ID patterns in query parameters from single IP addresses
• GraphQL queries targeting order data without accompanying authentication tokens
• Anomalous access patterns to order endpoints during non-business hours

Detection Strategies

• Monitor GraphQL endpoint access logs for unauthenticated requests to the order() query
• Implement rate limiting detection rules for order-related GraphQL queries
• Configure SIEM alerts for bulk data extraction patterns from e-commerce endpoints
• Review web application firewall (WAF) logs for suspicious GraphQL query patterns

Monitoring Recommendations

• Enable detailed logging for all GraphQL API requests, particularly those accessing sensitive order data
• Implement anomaly detection for unusual query volumes or patterns against order endpoints
• Set up alerts for authentication bypass attempts on protected resources
• Monitor for data exfiltration indicators such as large response payloads to unknown clients

How to Mitigate CVE-2026-24136

Immediate Actions Required

• Upgrade Saleor to patched versions: 3.22.29, 3.21.45, or 3.20.110 immediately
• Audit access logs for signs of prior exploitation or unauthorized order data access
• Review and inventory orders created before version 3.2.0 that may contain exposed PII
• Notify affected customers if evidence of data exfiltration is discovered

Patch Information

Saleor has released security patches across all affected version branches. Organizations should upgrade to the following versions based on their current deployment:

• Version 3.22.29 for installations running 3.22.x (see commit aeaced8)
• Version 3.21.45 for installations running 3.21.x (see commit 9bcd4f9)
• Version 3.20.110 for installations running 3.20.x (see commit 718ce1b)

Additional commit 5dab185 contains related security fixes. Full details are available in the GitHub Security Advisory.

Workarounds

• Deploy a Web Application Firewall (WAF) rule to block non-staff users from accessing the order() GraphQL query
• Implement network-level access controls to restrict GraphQL endpoint access to authenticated sessions only
• Consider temporarily disabling public access to the GraphQL API until patches can be applied
• Add custom middleware to enforce authentication on sensitive GraphQL queries as an interim measure

# Example WAF rule concept for blocking unauthenticated order queries
# Specific implementation varies by WAF vendor
# Block GraphQL requests containing "order(" query without valid authentication headers
# Rule: IF request.path contains "/graphql/" 
#       AND request.body contains "order(" 
#       AND request.headers["Authorization"] is empty
#       THEN block request