CVE-2026-48744

Executive Summary

CVE-2026-48744 is a broken authorization vulnerability in Saleor, an open-source e-commerce platform, affecting versions 3.14.67 through 3.21.67, 3.22.x prior to 3.22.63, and 3.23.x prior to 3.23.22. The flaw resides in the permission utility module (saleor/permission/utils.py) and allows unauthenticated, anonymous GraphQL requests to bypass authorization checks. Exploitation enables attackers to modify critical channel order settings via the channelUpdate() mutation and to enumerate hidden objects through pageType() and translation() queries that should be restricted to users with management permissions. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network attack vector, low attack complexity, and no authentication requirement, making it remotely exploitable by anyone with network access to the Saleor GraphQL endpoint.

Technical Analysis

The vulnerability stems from a broken authorization check in Saleor's permission utility component, specifically in the file saleor/permission/utils.py. This module is responsible for evaluating whether a requesting user possesses the necessary permissions to execute specific GraphQL operations. The flaw allows the authorization logic to incorrectly grant access to unauthenticated requests, meaning the permission verification can be bypassed when the request originates from an anonymous caller.

The attack surface is the public-facing GraphQL API endpoint exposed by Saleor installations. GraphQL APIs inherently provide a rich, queryable interface that aggregates multiple operations. In this case, specific GraphQL operations are affected:

1. channelUpdate() mutation: This operation is designed to modify channel configuration parameters, including order settings such as allowUnpaidOrders. The vulnerability permits anonymous callers to invoke this mutation and alter these settings, even though the API response may report a PermissionDenied error. This discrepancy between the reported response and the actual effect on the system is a critical indicator that the mutation is partially executed despite the authorization failure.

2. pageType() query: This query retrieves page type definitions. The broken authorization allows anonymous users to access objects that should be restricted, including hidden objects that are only intended for users with management-level permissions.

3. translation() query: Similar to pageType(), this query can return translation data for various entities, and the authorization flaw exposes underlying objects that should remain hidden.

The vulnerability also leaks attributes where the visibleInStorefront field is set to false. These attributes are intended to be hidden from public-facing storefront views and should only be visible to users possessing management permissions. The broken authorization allows the permission utility to return these hidden attributes to anonymous callers.

The root cause is a logic error in the permission validation flow within saleor/permission/utils.py, where the authorization check completes incorrectly — either by returning a success code when it should fail, or by failing to short-circuit the operation when permission is denied, allowing the operation to continue executing with the mutation/query's effects applied before the error is surfaced.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification Attackers identify Saleor-based e-commerce sites by fingerprinting the GraphQL endpoint. Saleor's GraphQL API responds to GET and POST requests, and the endpoint typically responds with GraphQL-specific error messages in JSON format when queried without authentication. Attackers can send an introspection query to enumerate available mutations and queries, confirming the presence of channelUpdate(), pageType(), and translation() operations.

Step 2: Triggering the Vulnerable Authorization Path Without any authentication token, the attacker sends a GraphQL request to the channelUpdate() mutation targeting a specific channel ID. The request is formatted as a standard GraphQL mutation with the necessary arguments (channel ID and a payload containing modified order settings). The broken authorization check in saleor/permission/utils.py incorrectly validates this anonymous request, allowing the mutation to proceed.

Step 3: Payload Execution at the Vulnerability-Class Level The attacker submits a mutation payload that sets allowUnpaidOrders to true (or modifies other channel order settings). Because the authorization check is flawed, the mutation executes and persists the changes to the database. The response may include a PermissionDenied error, but the state change has already been committed. Simultaneously, the attacker can issue pageType() and translation() queries to enumerate hidden objects, including attributes with visibleInStorefront set to false, thereby exfiltrating sensitive configuration data and business logic details.

Step 4: Post-Exploitation Impact Successful exploitation results in both confidentiality and integrity impacts. The attacker gains unauthorized read access to hidden platform objects and unauthorized write access to channel order configuration. Enabling allowUnpaidOrders could permit customers to place orders without payment, leading to financial loss. The data leakage from hidden attributes could expose internal product categorization, pricing logic, or operational details useful for further attacks.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The actual implementation details of the permission bypass remain undisclosed.

Impact Assessment

CVSS Analysis (6.5 Medium): The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates a network-exploitable vulnerability requiring no privileges and no user interaction. Attack complexity is low, meaning exploitation is straightforward once the endpoint is discovered. Impact is limited to low confidentiality loss and low integrity loss with no availability impact.

Business Impact: For e-commerce operators, the integrity impact is the most concerning. An attacker who modifies allowUnpaidOrders or related channel settings can cause financial losses through unauthorized order placement. The confidentiality impact, while rated low, can expose hidden product attributes and internal configuration that may reveal pricing strategies, margin information, or unpublished product data.

Affected Systems: All Saleor deployments running versions from 3.14.67 through 3.21.67 (the 3.14-3.21 release line), versions 3.22.0 through 3.22.62, and versions 3.23.0 through 3.23.21 are affected. Given that Saleor is a self-hosted, open-source platform, organizations run it on their own infrastructure, meaning the GraphQL API is exposed directly to the internet or internal networks.

Blast Radius: Since the vulnerability is authentication-independent (PR:N), any network-accessible Saleor instance is at risk. The low severity rating reflects limited scope (S:U — no privilege escalation, single security scope), but in an e-commerce context, even low-severity authorization flaws can translate to meaningful financial impact.

Detection Guidance

Sigma Rule

title: Saleor GraphQL Unauthenticated channelUpdate Mutation
id: e1c23d45-6a7b-4c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects unauthenticated GraphQL requests targeting channelUpdate mutation or pageType/translation queries in Saleor
author: Valtersit Threat Intelligence
date: 2026/06/15
logsource:
  category: webserver
  product: nginx
  definition: 'Monitor HTTP access logs for Saleor GraphQL endpoint traffic'
detection:
  selection_graphql_path:
    cs-uri-path:
      - '/graphql'
  selection_anonymous:
    cs-useragent: '*'  # Adjust based on logging context
  selection_operation:
    cs-uri-query|contains:
      - 'channelUpdate'
      - 'pageType'
      - 'translation'
  condition: selection_graphql_path and selection_operation and not selection_authenticated
  filter_authenticated:
    cs-username|exists: true
level: high
falsepositives:
  - Legitimate unauthenticated access to page types intended for public display
  - Scanning tools performing GraphQL introspection
fields:
  - src_ip
  - cs-uri-query
  - cs-username
  - sc-status
tags:
  - attack.t1190
  - cve.2026.48744
  - cwe.285

YARA Rule

rule Saleor_Unauthorized_GraphQL_Access {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects GraphQL payloads targeting Saleor channelUpdate, pageType, translation operations"
        cve = "CVE-2026-48744"
        date = "2026-06-15"
        severity = "medium"
    strings:
        $channel_update = "channelUpdate" ascii nocase
        $allow_unpaid = "allowUnpaidOrders" ascii nocase
        $page_type = "pageType" ascii nocase
        $translation_q = "translation" ascii nocase
        $graphql = "query" ascii nocase
        $mutation = "mutation" ascii nocase
        $channel_id = "channelId" ascii nocase
    condition:
        (uint16(0) == 0x0A0D or uint16(0) == 0x2028 or #graphql > 0) and
        any of ($channel_update, $page_type, $translation_q) and
        (#allow_unpaid > 0 or #channel_id > 0)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-48744 Saleor unauthorized channelUpdate GraphQL attempt"; flow:established,to_server; http.uri; content:"/graphql"; http.request_body; content:"channelUpdate"; nocase; http.request_body; content:"allowUnpaidOrders"; nocase; sid:2026487; rev:1; metadata:attack_target_web, created_at_2026_06_15, cve_CVE-2026-48744; classtype:attempted-admin; priority:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.category == "network" and
    network.protocol == "http" and
    http.request.method == "POST" and
    url.path == "/graphql" ]
  [ network where event.category == "network" and
    url.path == "/graphql" and
    (http.request.body.text contains "channelUpdate" or
     http.request.body.text contains "pageType" or
     http.request.body.text contains "translation") and
    not user.name exists ]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/graphql"
| regex _raw="event":(channelUpdate|pageType|translation)"
| search NOT user_name=*
| stats count by src_ip, uri_query, _time
| where count >= 3
| table _time, src_ip, uri_query, count
| sort - count

Wazuh OSSEC Rule

<group name="saleor,graphql,cve_2026_48744,">
  <rule id="100387" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/graphql</field>
    <regex>channelUpdate|pageType|translation</regex>
    <description>Saleor GraphQL unauthorized operation attempt (CVE-2026-48744)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_exploitation_public_app</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The vulnerability is confirmed as UNPATCHED with confidence 0/4 according to tracked patch sources. However, the vendor has identified fixed versions: 3.21.67, 3.22.63, and 3.23.22. These fixes are released, but the patch evidence source tracking indicates no verification from the tracked feeds at the time of this report. Organizations should verify availability of these versions from the official Saleor repository.

Immediate Mitigations:

1. Restrict network access to the GraphQL endpoint. If the API is not required to be publicly accessible, place it behind a VPN or apply IP allowlisting.
2. Deploy a Web Application Firewall (WAF) with rules to inspect GraphQL requests and block unauthenticated mutations to channelUpdate. The Suricata rule above can be converted to WAF configuration.
3. Enable detailed logging for the GraphQL endpoint and monitor for anomalous unauthenticated requests, particularly those containing mutation operations.
4. If possible, disable anonymous access to the GraphQL API by requiring API tokens for all operations, even if this affects legitimate public functionality.
5. Regularly audit channel configuration, specifically allowUnpaidOrders settings, to detect unauthorized changes.

Patch/Upgrade Steps:

1. Monitor the official Saleor repository for version 3.21.67, 3.22.63, or 3.23.22 release notes and availability.
2. Test the upgrade in a staging environment that mirrors production configuration.
3. Backup the database before applying any migration.
4. Apply the upgrade and verify that the authorization checks in saleor/permission/utils.py are corrected by testing anonymous GraphQL operations.

Long-Term Hardening:

1. Implement a robust API authentication schema. Even for public-facing GraphQL endpoints, require a token for mutating operations while allowing read-only anonymous access if needed.
2. Adopt a security-aware development process that includes threat modeling for authorization logic, particularly in permission utility modules.
3. Deploy GraphQL-specific security tooling (e.g., GraphQL introspection disablement in production, query complexity analysis) to reduce the attack surface.
4. Integrate vulnerability scanning for open-source dependencies and self-hosted platforms into the CI/CD pipeline.
5. Subscribe to Saleor's security advisories to receive timely notification of future vulnerabilities.

References

1. NVD Entry CVE-2026-48744 — https://nvd.nist.gov/vuln/detail/CVE-2026-48744
2. Saleor Official Repository (for patch verification) — https://github.com/saleor/saleor
3. Saleor Security Advisory (if published) — https://saleor.io/blog/security
4. MITRE ATT&CK Technique T1190 — https://attack.mitre.org/techniques/T1190/
5. FIRST.org EPSS (for future scoring updates) — https://www.first.org/epss/

Known Threat Actor Campaigns: No exploit-in-the-wild evidence or threat actor campaigns have been reported for CVE-2026-48744 at the time of writing. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Given the technical sophistication required to craft GraphQL attacks, exploitation is likely limited to targeted attackers rather than mass opportunistic scanning. However, the authentication-free nature of the flaw increases its attractiveness to automated exploitation frameworks once a PoC becomes publicly available.