PYSEC-2026-747

vendorUSosv

Missing Authentication for Critical Function in Saleor

view advisory published 2026-07-02Licence: CC-BY-4.0

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-7964US	medium5.3OT elevated	1.09% (65th)	—	2020-01-24
An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-rgcm-rpq9-9cgrADVISORY
https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3WEB
https://github.com/mirumee/saleor/releases/tag/2.9.1WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-7964ADVISORY
https://pypi.org/project/saleorPACKAGE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan