Saleor CVE-2026-44472 Pre-auth Account Takeover & GraphQL Auth Bypass Fixes

Vulnerability Overview CVE-2026-44472: Fixes an account pre-hijacking vulnerability stemming from unvalidated anonymous order merging. CVE-2026-48744: Fixes an issue where anonymous users can bypass authorization checks within specified GraphQL paths. Affected Range CVE-2026-44472: Affects all users utilizing the unvalidated anonymous order merging feature. CVE-2026-48744: Affects all users utilizing GraphQL paths, particularly those that may involve sensitive operations. Remediation CVE-2026-44472: The vulnerability is fixed by validating anonymous order merging. CVE-2026-48744: The vulnerability is fixed by strengthening authorization checks for GraphQL paths. Additional Information Contributors: NyanKiyoshi, OxSmiley, and paveikohout396. Release Date: 3 weeks ago. Commits: 437 commits. Version: 3.22.63. Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code (tar.gz) Release provenance (json) Release Date 3 weeks ago Commits 437 commits Version 3.22.63 Notes Please follow the upgrade guide, especially when using the mutation (CVE-2026-44472). Full Changelog 3.22.62...3.22.63 Resources Source code (zip) Source code (tar.gz) Release provenance (json) Contributors NyanKiyoshi, OxSmiley, and paveikohout396. Assets Source code (zip) Source code

Goal Reached Thanks to every supporter — we hit 100%!

Saleor CVE-2026-44472 Pre-auth Account Takeover & GraphQL Auth Bypass Fixes

More from this source