CVE-2026-44472: Saleor E-Commerce Auth Bypass Vulnerability

CVE-2026-44472 Overview

CVE-2026-44472 is an authentication bypass vulnerability [CWE-287] in Saleor, an open-source e-commerce platform. The flaw affects Saleor releases from 2.10.0rc1 through 3.21.66, 3.22.62, and 3.23.21. The account activation flow treats email verification as sufficient proof of ownership and automatically merges anonymous commerce data into the newly activated account. An attacker who pre-registers an account with a victim's email address can hijack the victim's order history, gift cards, and personal data once the victim clicks the activation link.

Critical Impact
Attackers gain unauthorized access to victims' order history, gift-card balances, names, addresses, and phone numbers without knowing the victim's password.

Affected Products

Saleor 2.10.0rc1 through 3.21.66
Saleor 3.22.0 through 3.22.62
Saleor 3.23.0 through 3.23.21

Discovery Timeline

2026-08-18 - CVE-2026-44472 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-44472

Vulnerability Analysis

Saleor's account activation flow conflates email possession with account ownership. When a user calls the accountRegister mutation, Saleor creates an inactive account tied to the supplied email address. The account becomes active only after the recipient of the activation email confirms the request. Attackers can exploit the window between account creation and legitimate registration by the true email owner.

Once activation occurs, saleor/graphql/account/mutations/account/confirm_account.py merges anonymous orders and gift cards that share the confirmed email address into the activated account. The merge occurs without requiring password confirmation or a second authentication factor. The attacker, who chose the password during pre-registration, then logs in and reads the victim's commerce history.

Root Cause

The root cause is a broken authentication design in the account confirmation logic. Saleor's implementation trusts that only the mailbox owner will click the activation link, but this assumption fails when the account was created by a third party. Merging anonymous commerce records at confirmation time transfers sensitive data based on email reachability alone, not proof of identity.

Attack Vector

The attack requires network access to the Saleor GraphQL API and user interaction from the victim, who must click the activation email. The attacker workflow proceeds as follows:

Attacker calls accountRegister with the victim's email and an attacker-controlled password.
Saleor creates an inactive account and dispatches an activation email to the victim.
The victim, believing the email is legitimate, follows the activation link.
Saleor activates the attacker's account and merges the victim's anonymous orders and gift cards into it.
The attacker signs in with the pre-chosen password and exfiltrates data.

python

# Patch introducing accountConfirmMergeMode to disable automatic merging by default
# Source: https://github.com/saleor/saleor/commit/299cdfb1a5737108b78b5c2c0d29b94f3b7331a2
import graphene

from ...site import (
    AccountConfirmMode,
    AnnouncementImportance,
    GiftCardSettingsExpiryType,
)
from ..core.doc_category import (
    DOC_CATEGORY_AUTH,
    DOC_CATEGORY_GIFT_CARDS,
    DOC_CATEGORY_SHOP,
)
from ..core.enums import to_enum

The patch adds an AccountConfirmMergeMode setting to the shop schema so operators can control or disable automatic merging of anonymous commerce data at account confirmation.

Detection Methods for CVE-2026-44472

Indicators of Compromise

accountRegister mutations submitted from IP addresses or user-agents inconsistent with the associated customer's usual traffic.
Confirmation of accounts followed by immediate logins from a different geographic region or client fingerprint.
Customer support tickets reporting activation emails for accounts the user did not create.
Rapid access to historical order data or gift-card redemptions immediately after confirmAccount succeeds.

Detection Strategies

Correlate GraphQL access logs for accountRegister, confirmAccount, tokenCreate, and me queries to spot pre-registration followed by data-harvesting sequences.
Alert on account activations where the pre-registration source IP differs from the activation source IP.
Track anonymous-to-authenticated order merges and flag accounts that absorb orders older than the account creation timestamp.

Monitoring Recommendations

Monitor spikes in accountRegister calls targeting existing customer email addresses.
Log and review the confirm_account.py code path for unusual merge volumes per account.
Retain activation email dispatch records and match them against confirmation source metadata for forensic review.

How to Mitigate CVE-2026-44472

Immediate Actions Required

Upgrade Saleor to 3.21.67, 3.22.63, or 3.23.22 on the corresponding release lines.
After upgrading, set accountConfirmMergeMode to disable automatic merging until operators validate the migration path.
Audit recent accountRegister and confirmAccount activity for suspicious pre-registration patterns and revoke compromised sessions.
Force password resets for accounts confirmed during the vulnerable window that show anomalous order merges.

Patch Information

Saleor released fixes in Saleor 3.21.67, Saleor 3.22.63, and Saleor 3.23.22. The patched lines disable automatic merging by default via the new accountConfirmMergeMode setting. The redesigned 3.24.0 flow requires password confirmation before anonymous objects are linked to a newly activated account. Full technical context is available in the GitHub Security Advisory GHSA-6whj-8p3f-2xqp.

Workarounds

Disable the automatic merge feature after upgrading by configuring accountConfirmMergeMode to require password confirmation.
Require customers to authenticate with their pre-existing password before linking anonymous orders or gift cards.
Rate-limit accountRegister mutations per email address and per source IP to slow pre-registration attacks.

bash

# Configuration example: query the shop for the active account confirm merge mode
curl -X POST https://saleor.example.com/graphql/ \
  -H "Content-Type: application/json" \
  -d '{"query": "{ shop { accountConfirmMergeMode } }"}'