Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-58442 EUVD-2025-27478

Saleor has user enumeration vulnerability due to different error messages

Published Sep 9, 2025 · Updated Sep 10, 2025 · Assigned by GitHub_M

Description

Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact.

Affected products

VendorProductAffectedFixed
saleor saleor >= 3.21.0, < 3.21.16 —

References