Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions

TRUNG BÌNH 4.3CVE-2023-26051 · GHSA-r8qr-wwg3-2r85 · PYSEC-2026-917 · Công bố 02/03/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-26051 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng saleor, saleor (saleor).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.82%, cao hơn 57.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.1.48, 3.10.14, 3.11.12, 3.7.59 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
saleor PyPI	`≥ 2.0.0, < 3.1.48≥ 3.10.0, < 3.10.14≥ 3.11.0, < 3.11.12≥ 3.7.0, < 3.7.59≥ 3.8.0, < 3.8.30≥ 3.9.0, < 3.9.27`	`3.1.483.10.143.11.123.7.593.8.303.9.27`
saleor saleor	`≥ 2.0.0, < 3.1.48≥ 3.10.0, < 3.10.14≥ 3.11.0, < 3.11.12≥ 3.2.0, < 3.7.59≥ 3.8.0, < 3.8.30≥ 3.9.0, < 3.9.27`	`3.1.483.10.143.11.123.7.593.8.303.9.27`

Mô tả

Impact

Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.

This issue has been patched in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14 and 3.11.12.

Workarounds

None

For more information

If you have any questions or comments about this advisory:

Open a discussion at https://github.com/saleor/saleor/discussions
Email us at [email protected]

Mô tả của NVD

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.