Is there a patch available for CVE-2026-39851?

Yes, a patch is available for CVE-2026-39851. Update the affected software to the latest version immediately.

Saleor CVE-2026-39851

Q: What is the CVSS score of CVE-2026-39851?

CVE-2026-39851 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-20536 MEDIUM

Observable Response Discrepancy (CWE-204)

2026-04-08 GitHub_M

Information Disclosure Saleor

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.20.118,3.22.47,3.23.0a3

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20536

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 17:33 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

AnalysisAI

Saleor e-commerce platform versions 2.10.0 through 3.23.0a2 leak user email addresses via error messages in the requestEmailChange() GraphQL mutation, allowing authenticated attackers to enumerate valid email addresses in the system. The vulnerability affects multiple version branches and is resolved in patched versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118. CVSS 5.3 reflects low confidentiality impact with authentication requirement.

Technical ContextAI

The vulnerability resides in Saleor's GraphQL API layer, specifically the requestEmailChange() mutation endpoint. The root cause is classified under CWE-204 (Observable Discrepancy), meaning the API returns different or revealing error messages that leak information about whether an email address exists in the user database. Authenticated users can exploit this by submitting email addresses to the mutation and observing error responses that confirm email existence, enabling user enumeration attacks. The issue affects Saleor's core authentication and user management logic across multiple release branches.

RemediationAI

Upgrade Saleor to patched versions immediately: 3.23.0a3 or later for the 3.23 branch, 3.22.47 or later for 3.22, 3.21.54 or later for 3.21, or 3.20.118 or later for 3.20. If immediate upgrade is not feasible, restrict access to the requestEmailChange() GraphQL mutation endpoint to trusted users only, or implement rate limiting on mutation calls to mitigate enumeration attacks. The upstream fixes are available via commits 7be352fa, cdb66da9, d6a94e95, e42aa4d6, and f0371bdd on the Saleor repository, which standardize error messages to avoid leaking email existence information. Review the advisory at https://github.com/saleor/saleor/security/advisories/GHSA-m3rm-m4vq-27x7 for version-specific guidance.