Security readout for executives and security teams
Plain-English summary
Saleor e-commerce sites running affected versions may expose order details to unauthenticated users through the GraphQL API. The disclosed impact is sensitive information exposure in plain text, including PII from orders created before Saleor 3.2.0. This is a high-priority privacy and customer trust issue for affected stores.
Executive priority
Patch or isolate affected Saleor stores urgently. The business risk is customer data exposure without authentication, which can trigger privacy, support, and reputational impacts. No active exploitation is confirmed in the provided sources, but the vulnerability characteristics justify fast remediation.
Technical view
CVE-2026-24136 is a CWE-639 IDOR in Saleor’s GraphQL API, affecting Saleor 3.2.0-3.20.109, 3.21.0-a.0-3.21.44, and 3.22.0-a.0-3.22.28. CVSS v4.0 is 8.7. The issue is patched in 3.20.110, 3.21.45, and 3.22.29.
Likely exposure
Internet-facing Saleor deployments with public GraphQL API access are the primary concern, especially stores with historical orders. Exposure depends on running an affected version and allowing non-staff access to order information through the order() GraphQL query.
Exploitation context
The CVE describes unauthenticated extraction of sensitive information. The source bundle does not show CISA KEV listing or public evidence of active exploitation. Treat as readily exploitable because the CVSS indicates network access, low complexity, no privileges, and no user interaction.
Researcher notes
The advisory identifies an IDOR affecting the order() GraphQL query. Avoid assuming broader Saleor components are affected beyond the cited ranges. The public data names patches and a WAF workaround but does not provide evidence of exploitation in the wild.
Mitigation direction
- Upgrade Saleor to 3.20.110, 3.21.45, or 3.22.29 as applicable.
- If immediate upgrade is not possible, block non-staff order() GraphQL access using a WAF.
- Review vendor advisory and commits before applying compensating controls.
- Prioritize environments storing customer PII or legacy orders created before Saleor 3.2.0.
Validation and detection
- Inventory Saleor instances and confirm exact deployed versions.
- Check whether public GraphQL endpoints expose order information to non-staff users.
- Verify patched versions are deployed after remediation.
- Review access logs for unusual unauthenticated order information requests.
- Confirm WAF rules block non-staff order() GraphQL requests if used.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-24136 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/saleor/saleor/security/advisories/GHSA-r6fj-f4r9-36grCVE reference · x_refsource_CONFIRM
- https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2faCVE reference · x_refsource_MISC
- https://github.com/saleor/saleor/commit/718ce1b4fc3aef68eeac1aea0cf1d70a614ba6afCVE reference · x_refsource_MISC
- https://github.com/saleor/saleor/commit/9bcd4f9000b189297eeb3ac88cc28c6c30229153CVE reference · x_refsource_MISC
- https://github.com/saleor/saleor/commit/aeaced8acb5e01055eddec584263f77e517d5944CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.