CVE-2026-44472

Executive Summary

CVE-2026-44472 is an authentication and authorization flaw in Saleor, an open-source e-commerce platform, affecting instances running from version 2.10.0rc1 through 3.21.66, 3.22.62, and 3.23.21. The vulnerability enables an attacker who creates an account using a victim's email address to gain access to that victim's order history and personally identifiable information (names, addresses, phone numbers) once the victim clicks the legitimate account activation link sent to their mailbox. The flaw stems from the account activation flow treating email verification as sufficient proof of ownership, which allows anonymous commerce data (orders and gift cards) to be merged into the attacker-controlled account without requiring a password or additional authentication factor. With a CVSS score of 8.1 (High), this flaw poses a serious privacy and data confidentiality risk to affected deployment tenants, though it requires victim interaction (clicking the activation link).

Technical Analysis

The vulnerability resides in Saleor's authentication and account lifecycle logic. The platform decouples account registration from account activation, allowing an anonymous actor to invoke account registration (accountRegister) with an arbitrary email address without possessing control of that mailbox. Saleor then sends an activation link to the provided email address. The design flaw is that when the legitimate owner of that mailbox later clicks the activation link, Saleor's activation logic treats the act of following the link as sufficient proof of account ownership. The platform proceeds to activate the account without requiring the account password, a second authentication factor, or proof of possession beyond the unauthenticated email click.

Critically, the activation flow invokes a merge operation for the anonymous commerce data associated with the same email address. The relevant code path — the confirmation mutation in the account activation module (saleor/graphql/account/mutations/account/confirm_account.py) — automatically associates and merges anonymous orders and gift-card data into the just-activated account. Because the account was created by the attacker, the merged data becomes accessible to the attacker upon subsequent logins. The attacker must only wait until the victim clicks the activation link, which occurs when the victim follows the link from the email notification. After activation, the attacker can authenticate to the account (the attacker knows the credentials they set during registration) and view all merged order history, including personal data fields such as names, shipping addresses, and phone numbers.

The vulnerability class is CWE-287 (Improper Authentication). The root cause is the insufficient distinction between "email delivery proves mailbox control" and "account ownership." The activation process conflates these two concepts. The impact is twofold: confidentiality loss (exposure of victim personal data and order details) and integrity impact (the attacker modifies the account's associated data state by merging anonymous objects into it). The attack requires no privileges and no user interaction beyond the victim clicking a link they legitimately receive. The attack surface is the publicly exposed GraphQL API endpoint that processes account registration and activation requests.

The patched versions (3.21.67, 3.22.63, 3.23.22) disable automatic merging of anonymous objects by default on the supported lines. The fully redesigned flow in version 3.24.0 requires password confirmation before anonymous objects (orders and gift cards) are linked to the activated account. The patches and redesign therefore break the precondition that the attacker's account automatically receives the victim's data upon activation.

No patch evidence from external tracker sources was found, and the patch confidence is rated 0/4 by the providing data source. This rating reflects the absence of confirmed patch artifacts from monitored trackers, not a statement on the efficacy of the vendor's advisory. The NVD description explicitly names the fixing versions, so organizations should treat the listed versions as authoritative.

Exploitation Scenarios

The following attack chain is inferred strictly from the NVD description, the CWE class, and the known Saleor GraphQL API structure. No public PoC or exploit code is available; the attack chain is described at the functional level.

Step 1 — Reconnaissance and Target Identification: An attacker identifies a publicly accessible Saleor instance (versions 2.10.0rc1 through 3.21.66, 3.22.62, or 3.23.21). The instance's GraphQL API is exposed, as is standard for Saleor deployments. The attacker may fingerprint the version via exposed API schema introspection or error messages that reveal version numbers. The attacker selects a victim whose email address will be used — this could be any person expected to make purchases on the vulnerable instance, or specifically an existing customer with a known email address from prior exposure.

Step 2 — Pre-registration of Victim Account: The attacker invokes the account registration GraphQL mutation (accountRegister) with the victim's email address and an attacker-chosen password. No authentication is required. Saleor processes the registration and dispatches an activation email to the victim's mailbox. Because registration is anonymous and unauthenticated, the attacker faces no access control obstruction at this stage.

Step 3 — Triggering the Flaw — Victim Interaction: The victim receives what appears to be a legitimate invitation or activation email from Saleor. If the victim is already a known user of the platform, they may assume the email relates to their existing account. The victim clicks the activation link in the email. Saleor's activation logic processes the link, confirms the email address, and activates the attacker-created account. The activation handler (the confirmation mutation in saleor/graphql/account/mutations/account/confirm_account.py) merges any anonymous orders and gift-card data associated with the victim's email address into the newly activated account. This merge occurs without requiring the account password or any second authentication factor.

Step 4 — Post-Exploitation Impact: The attacker logs into the activated account using the credentials they set during registration. The attacker now views the victim's complete order history, including names, shipping and billing addresses, phone numbers, and any gift-card balances merged into the account. The attacker can also potentially use stored payment data or gift-card values for financial gain, though the NVD description specifically confirms access to order history and personal data. The attacker may also modify account details, change the password, or further pivot using the exposed data. The integrity impact arises from the attacker's ability to alter the account state and take over the account entirely after the merge.

Impact Assessment

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) yields a base score of 8.1 (High). The network attack vector, low attack complexity, and no privilege requirement make this an accessible attack. The requirement for user interaction (the victim clicking the activation link) is the moderating factor. The scope is unchanged (U), meaning the impact is contained to the application and its data. Confidentiality impact is High — exposure of PII (names, addresses, phone numbers) and order history constitutes a severe privacy breach that may trigger regulatory notification obligations (GDPR, CCPA, and similar). Integrity impact is High — the attacker gains full control over the account and its merged data. Availability impact is None (A:N), as the attack does not cause denial of service.

Business impact for affected e-commerce deployments includes legal and regulatory consequences of a PII breach, reputational damage, loss of customer trust, and potential financial liability. The blast radius is per-account and per-victim, but an attacker can repeat the attack against multiple victims in the same instance, leading to mass data exposure. Because the attack relies on victim interaction, it is somewhat self-limiting, but social engineering and the legitimate-looking nature of the activation email can drive meaningful click rates. Affected systems are all Saleor instances within the stated version ranges; SaaS instances and self-hosted deployments are equally vulnerable unless already upgraded.

Detection Guidance

The following detection rules are generic and based on the vulnerability class (improper authentication through account creation and activation). Specific identifiers (e.g., mutation names) are limited to those explicitly in the NVD description. Detection should focus on anomalous account registration and activation patterns.

Sigma Rule

title: Saleor Account Activation and Merge Anomaly
id: 8d806e60-7f24-4e65-9c33-71b3a3f1c4f2
status: experimental
description: Detects patterns consistent with CVE-2026-44472 - attacker-created account activated by victim, followed by data merge.
logsource:
    category: application
    product: saleor
detection:
    selection_registration:
        event: accountRegister
        email: "*"
    selection_activation:
        event: accountConfirm
        same_ip_analysis: "false"  # activation from different IP than registration
    selection_merge:
        event: account_data_merge
        auto_merge: "true"
    condition: selection_registration and selection_activation and selection_merge
falsepositives:
    - Legitimate account creation where the same user later activates from a different IP
level: medium

YARA Rule

rule Saleor_Account_Activation_Flaw
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects code references to the vulnerable account activation and merge logic in Saleor"
        cve = "CVE-2026-44472"
        date = "2026-05-15"
    strings:
        $confirm_path = "saleor/graphql/account/mutations/account/confirm_account.py" ascii nocase
        $merge_anonymous = "merge anonymous" ascii nocase
        $auto_associate = "automatically associates" ascii nocase
        $activation = "activation" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x457F) and  // PE or ELF (compiled)
        any of them
        or (all of them and filesize < 10MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Saleor CVE-2026-44472 Account Activation and Merge Attempt"; flow:established,to_server; content:"accountRegister"; http_client_body; nocase; content:"accountConfirm"; http_client_body; nocase; content:"email"; http_client_body; nocase; classtype:attempted-user; sid:5000444; rev:1;)

Elastic Detection

sequence by user.email with maxspan=1h
  [authentication where event.action == "accountRegister" and not source.ip == <known_registration_ips>]
  [authentication where event.action == "accountConfirm" and source.ip != <ip_from_previous_event>]
  [audit where event.action == "data_merge" and data.merge_type == "anonymous_to_account"]

Splunk SPL Query

index=main sourcetype=saleor* (event="accountRegister" OR event="accountConfirm")
| transaction email maxspan=1h
| where event=="accountRegister" AND event=="accountConfirm" AND NOT (src_ip=previous_src_ip)
| table _time, email, src_ip, user
| search event="data_merge" OR action="merge"

Wazuh OSSEC Rule

<group name="saleor_cve_2026_44472,">
  <rule id="100444" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">accountRegister</field>
    <field name="email">\.+</field>
    <description>CVE-2026-44472: Saleor account registration with victim email detected</description>
    <group>saleor,attack,authentication,</group>
  </rule>
  <rule id="100445" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">accountConfirm</field>
    <field name="ip_difference">true</field>
    <description>CVE-2026-44472: Saleor account activation from different IP than registration</description>
    <group>saleor,attack,authentication,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

Immediate mitigations (in the absence of a verified patch):

1. Upgrade to the fixed versions identified by the vendor: 3.21.67, 3.22.63, or 3.23.22. These versions disable automatic merging of anonymous objects by default.
2. If upgrading is not immediately possible, disable the automatic linkage of anonymous orders and gift cards to activated accounts via platform configuration, if the current version supports this toggle.
3. Contact Saleor support to obtain the patch artifacts directly and confirm their integrity before deployment.
4. Audit existing accounts for signs of pre-registration abuse: review accounts where registration and activation timestamps are close together, or where activation originated from a different IP/geographic region than registration.
5. Notify users with potentially affected accounts to reset passwords and review their order history for anomalies.

Patch/upgrade steps:

1. Schedule a maintenance window for the Saleor instance.
2. Backup the database and application configuration before applying the upgrade.
3. Review the upgrade notes for version 3.21.67 (or 3.22.63 / 3.23.22) to understand the configuration changes related to automatic merging.
4. Perform the upgrade following Saleor's official documentation for your installation method (Docker, Kubernetes, or bare metal).
5. After the upgrade, verify the new behavior: attempt the attack pattern internally (create an account with a test email, activate it, confirm no data merge occurs) to validate the fix.
6. For full protection, plan a subsequent upgrade to 3.24.0 or later, where the redesigned flow requires password confirmation before anonymous objects are linked.

Long-term hardening:

1. Enforce strong authentication for all account-related actions, including activation. Consider requiring a one-time password or confirmation code alongside the activation link.
2. Implement rate limiting and anomaly detection on the account registration and activation endpoints to flag repeated registration attempts for the same email.
3. Monitor for mass account creation patterns targeting a single domain or customer list.
4. Review the platform's data-merge logic for similar flaws in other account lifecycle events (password reset, email change).
5. Maintain a vulnerability management process that tracks Saleor security advisories and applies patches within a defined SLA.
6. Consider a Web Application Firewall (WAF) rule to block abnormal GraphQL requests targeting account activation mutations (though rule efficacy may be limited without a specific payload signature).

References

1. NVD Entry — CVE-2026-44472: https://nvd.nist.gov/vuln/detail/CVE-2026-44472
2. Saleor Official Site / Advisory: https://saleor.io/ (vendor security advisory page — verify the specific advisory ID)
3. MITRE CWE-287 (Improper Authentication): https://cwe.mitre.org/data/definitions/287.html
4. CISA KEV Catalog: Not listed (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

No known threat actor campaigns or exploit-in-the-wild evidence are available for this CVE at the time of writing. The exploit status is unknown, and no public PoC code has been confirmed. Organizations should treat this as a high-priority fix given the ease of exploitation and the sensitivity of data exposed.