CVE-2026-35407: Authorization Flaw in Saleor E-commerce

The core of this vulnerability lies in the flawed email change confirmation workflow within Saleor. An attacker can exploit this by obtaining a valid email change confirmation token generated for one user account. Crucially, the system fails to verify that this token was actually issued for the account the attacker is currently authenticated as. This allows the attacker, while logged in as a different user, to replay the token and update another user's email address to the one specified in the token. This effectively enables account takeover, as the victim will receive email notifications intended for the attacker, potentially losing access to their account. The blast radius extends to all users whose email addresses can be manipulated through this token replay attack. While no direct data exfiltration is inherent in the vulnerability, the compromised email address can be used for further phishing attacks or to reset passwords on other services, significantly expanding the potential damage.

1. Reserved2026-04-02
2. Published2026-04-08
3. Modified2026-04-10
4. EPSS updated2026-04-16

The primary mitigation for CVE-2026-35407 is to immediately upgrade Saleor to version 3.23.0a3 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Review and strengthen the email change confirmation process to ensure proper user authentication and token validation. Implement stricter rate limiting on email change requests to prevent brute-force attempts to obtain valid tokens. Consider implementing multi-factor authentication (MFA) to add an extra layer of security, even if the email address is compromised. Monitor Saleor logs for suspicious activity related to email changes, such as unusually frequent requests or changes to accounts with unusual patterns. After upgrading, confirm the fix by attempting to trigger the email change workflow with a token generated for a different user account – the process should now correctly reject the token.