CVE-2023-26051: Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions
(updated )
Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.
This issue has been patched in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14 and 3.11.12.
References
- github.com/advisories/GHSA-r8qr-wwg3-2r85
- github.com/pypa/advisory-database/tree/main/vulns/saleor/PYSEC-2026-917.yaml
- github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1
- github.com/saleor/saleor/releases/tag/3.1.48
- github.com/saleor/saleor/releases/tag/3.10.14
- github.com/saleor/saleor/releases/tag/3.11.12
- github.com/saleor/saleor/releases/tag/3.7.59
- github.com/saleor/saleor/releases/tag/3.8.30
- github.com/saleor/saleor/releases/tag/3.9.27
- github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85
- nvd.nist.gov/vuln/detail/CVE-2023-26051
Code Behaviors & Features
Detect and mitigate CVE-2023-26051 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →