CVE-2026-48744: Saleor Auth Bypass Vulnerability

CVE-2026-48744 Overview

CVE-2026-48744 is a broken authorization vulnerability [CWE-285] in Saleor, an open-source GraphQL-based e-commerce platform. The flaw resides in saleor/permission/utils.py and affects versions from 3.14.67 up to (but not including) 3.21.67, 3.22.63, and 3.23.22. The permission utility incorrectly authorizes unauthenticated GraphQL requests, allowing anonymous callers to invoke privileged operations such as the channelUpdate() mutation. Attackers can modify sensitive channel order settings, including allowUnpaidOrders, even when the API returns PermissionDenied. The same defect exposes hidden objects through the pageType() and translation() queries, revealing attributes whose visibleInStorefront field is false.

Critical Impact
Unauthenticated attackers can alter channel order settings and read hidden storefront objects intended only for administrators.

Affected Products

Saleor versions 3.14.67 through 3.21.66
Saleor versions 3.22.0 through 3.22.62
Saleor versions 3.23.0 through 3.23.21

Discovery Timeline

2026-08-18 - CVE-2026-48744 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-48744

Vulnerability Analysis

The vulnerability affects Saleor's GraphQL API permission enforcement layer. The helper function in saleor/permission/utils.py returns an empty list of permission-check results when no requestor is present in the GraphQL context. Downstream authorization logic interprets an empty list as "no failures," effectively granting anonymous callers access to gated operations. Attackers can exploit this to invoke management-only mutations such as channelUpdate(), changing configuration values like allowUnpaidOrders that govern payment enforcement on orders.

The same defect propagates to read-side queries. The pageType() and translation() resolvers rely on the shared permission utility and consequently expose attributes hidden from the storefront. Fields marked with visibleInStorefront = false become readable without authentication, leaking data restricted to users holding management permissions.

Root Cause

The root cause is missing negative-case handling in the permission utility. When requestor is None (anonymous request), the function returned an empty list rather than a list of denied results. Callers that check whether any element is False incorrectly conclude authorization succeeded.

Attack Vector

Exploitation is network-based, requires no authentication, and no user interaction. An attacker sends a crafted GraphQL request directly to the Saleor API endpoint invoking channelUpdate(), pageType(), or translation() operations.

python

# Patch from saleor/permission/utils.py fixing CVE-2026-48744
    requestor = get_user_or_app_from_context(context)

-    perm_checks_results = []
-    if requestor and permissions:
-        perm_checks_results = [requestor.has_perm(perm) for perm in permissions]
-    return perm_checks_results
+    if not permissions:
+        return []
+    if not requestor:
+        return [False]
+    return [requestor.has_perm(perm) for perm in permissions]

Source: Saleor commit 11efb4e. The patch explicitly returns [False] when no requestor is present, forcing downstream logic to deny anonymous callers.

Detection Methods for CVE-2026-48744

Indicators of Compromise

Unauthenticated GraphQL requests targeting channelUpdate, pageType, or translation operations in Saleor access logs.
Unexpected changes to channel configuration fields such as allowUnpaidOrders without a corresponding authenticated administrator session.
GraphQL responses containing PermissionDenied errors that nevertheless coincide with successful state mutations.

Detection Strategies

Review GraphQL request logs for mutation operations executed without an Authorization header or authenticated app token.
Correlate channelUpdate calls with the source IP and session context to identify calls from anonymous clients.
Audit recent modifications to channel order settings and compare against expected administrator activity.

Monitoring Recommendations

Enable verbose GraphQL request logging capturing operation name, variables, and requestor identity.
Alert on any successful channelUpdate mutation lacking an authenticated principal.
Monitor query patterns for enumeration of pageType and translation objects from unauthenticated sources.

How to Mitigate CVE-2026-48744

Immediate Actions Required

Upgrade Saleor to version 3.21.67, 3.22.63, or 3.23.22 depending on the deployed release branch.
Audit channel settings, especially allowUnpaidOrders, and revert any unauthorized modifications.
Review recent GraphQL request logs for unauthenticated invocations of affected operations.

Patch Information

The fix is available in Saleor releases 3.21.67, 3.22.63, and 3.23.22. Technical details are documented in the GitHub Security Advisory GHSA-xqqq-qhgq-gx53.

Workarounds

Place the Saleor GraphQL endpoint behind an authenticating reverse proxy that rejects unauthenticated requests to mutation operations.
Apply Web Application Firewall (WAF) rules blocking anonymous GraphQL requests referencing channelUpdate, pageType, or translation until the upgrade is complete.
Restrict network exposure of the Saleor API to trusted client applications while patching is scheduled.

bash

# Upgrade Saleor to a patched release using pip
pip install --upgrade "saleor==3.23.22"

# Verify installed version
python -c "import saleor; print(saleor.__version__)"