CVE-2026-24136

HIGH

Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-24136 has a selected CVSS score of 8.7 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 could have PIIs exfiltrated. The issue has been patched in Saleor versions: 3.22.29, 3.21.45, and 3.20.110. To workaround, temporarily block non-staff users from fetching order information (the order() GraphQL query) using a WAF.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 26, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

saleor

Browse saleor / saleor
CVE List>= 3.22.0-a.0, < 3.22.29affected
>= 3.21.0-a.0, < 3.21.45affected
>= 3.2.0, < 3.20.110affected

Proofs of concept

1

Repository PoCs

GitHubBlankBire/CVE-2026-24136-LabRepository PoCby BlankBire1Exploit8 files

57.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-24136, an IDOR vulnerability in Saleor's GraphQL API, by sending unauthenticated queries to retrieve personally identifiable information (PII) from orders.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and a PoC script for CVE-2026-24136, an IDOR vulnerability in Saleor. The PoC script sends unauthenticated GraphQL queries to a local Saleor instance to demonstrate PII exfiltration. No backdoor, concealed operator-directed harm, or deceptive payload was observed. The script's behavior is consistent with its stated purpose of demonstrating the vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareSaleor
Attack typesIDORInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary purpose is to exercise the vulnerability by sending unauthenticated requests to extract PII. It is described as a 'PoC khai thác' (exploit PoC) and its functions are named 'attack_single', 'attack_enumerate', and 'attack_from_file'. It does not merely check for the vulnerability's existence; it actively retrieves and displays sensitive data.

scripts/poc_cve_2026_24136.py:1-11scripts/poc_cve_2026_24136.py:196

Requirements

  • A running, vulnerable Saleor instance (versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44, or 3.22.0-a.0 through 3.22.28).README.md:10
  • Knowledge of a valid Saleor order ID, either as a sequential integer (for older versions) or a base64-encoded global ID (for versions using UUIDs).scripts/poc_cve_2026_24136.py:198-202

Observed behavior

  • Sends a GraphQL query to the Saleor API endpoint without any authentication headers.scripts/poc_cve_2026_24136.py:103-115
  • Extracts and displays PII such as email, full name, phone number, and address from the API response.scripts/poc_cve_2026_24136.py:134-194
  • Supports multiple attack modes: targeting a single order, enumerating a range of sequential order IDs, and reading order IDs from a file.scripts/poc_cve_2026_24136.py:196-304
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe PoC script sends POST requests to this endpoint to exploit the IDOR vulnerability. This is the expected target for the PoC and does not indicate a backdoor.scripts/poc_cve_2026_24136.py:24scripts/poc_cve_2026_24136.py:109-110
Data Exfiltration
Payload withheldThe PoC extracts and displays PII from order data, which is the intended demonstration of the CVE's impact. The data is only printed to the console or saved to a local file specified by the user.scripts/poc_cve_2026_24136.py:38-85scripts/poc_cve_2026_24136.py:134-194
Review boundaries

What the analysis did not establish

  • The evidence packet reports 'complete_artifact_coverage: false' and 'unclassified_bytes: 23919' from 6 files, indicating that not all files in the repository were provided for analysis. The analysis is based on the two provided text files: README.md and scripts/poc_cve_2026_24136.py.
  • Six files in the repository were not included in the text evidence; their content is unknown. The inventory lists them as binary or unclassified files, but their metadata was not analyzed for backdoor behavior.
  • The review is limited to static analysis of the provided text; the script was not executed, and no dynamic behavior was observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

BlankBire/CVE-2026-24136-LabCreated Vuln labCVE-2026-24136Compose · images

1 Compose manifest · 4 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a CVE-2026-24136 vulnerability lab, running a vulnerable Saleor e-commerce platform (version 3.20) with PostgreSQL, Redis, and an optional dashboard. The lab demonstrates an unauthenticated IDOR vulnerability in the Saleor GraphQL API that leaks customer PII.

docker-compose.yml:1-5README.md:1-10

Lab assessment

Vulnerability lab

The README explicitly states the environment is a lab for CVE-2026-24136, a Saleor IDOR vulnerability. The Compose file runs a vulnerable Saleor version (3.20), and the repository includes a PoC script and seed data script to demonstrate the exploit.

README.md:1-10docker-compose.yml:1-5
Lab shapeCompose · images
Services4
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

PostgreSQL 15 Alpine container storing Saleor data. Configured with a healthcheck and a named volume for persistence.

docker-compose.yml:9-22

redis

message brokercache

Redis 7 Alpine container used as a Celery broker and cache backend for Saleor.

docker-compose.yml:25-29

saleor_api

vulnerable targetGraphQL API

Saleor 3.20 API container, the vulnerable component. It runs a startup script that patches a wsgi bug, applies migrations, and starts gunicorn. Exposes port 8000. The README and PoC target this service to demonstrate the IDOR.

docker-compose.yml:33-68README.md:11-15

dashboard

optional GUI

Saleor Dashboard 3.20 container, an optional web UI for managing the store. Exposes port 9000.

docker-compose.yml:71-79

start_api.sh

startup scriptpatch

A shell script mounted into the saleor_api container. It applies Django migrations, collects static files, patches a wsgi compatibility bug, and starts the gunicorn server.

scripts/start_api.sh:1-38docker-compose.yml:63-65

seed_data.py

data seeder

A Python script that creates victim customer accounts and draft orders with PII (names, addresses, phone numbers) in the Saleor instance, providing data for the PoC to exploit.

scripts/seed_data.py:1-10README.md:44-45

poc_cve_2026_24136.py

proof-of-concept exploit

A Python script that exploits the CVE-2026-24136 IDOR vulnerability by sending unauthenticated GraphQL queries to the Saleor API to exfiltrate PII from orders. Supports single, enumerate, and file-based attack modes.

scripts/poc_cve_2026_24136.py:1-12README.md:46-47

setup_lab.sh

lab setup automation

A Bash script that automates the lab setup: checks dependencies, starts containers, waits for the API, creates an admin user, populates sample data, and runs the seed script.

setup_lab.sh:1-93

setup_lab.ps1

lab setup automation

A PowerShell script that automates the lab setup on Windows, performing the same steps as setup_lab.sh.

setup_lab.ps1:1-118
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-24136

Supported by supplied evidence

The entire lab is built around CVE-2026-24136. The README describes the vulnerability, affected versions, and patch. The Compose file uses a vulnerable Saleor image (3.20). The PoC script is named after the CVE and demonstrates unauthenticated PII exfiltration via the order query, matching the described IDOR.

README.md:1-10docker-compose.yml:33-36scripts/poc_cve_2026_24136.py:1-12
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed and running.README.md:52-54setup_lab.sh:20-24
  • Python 3.8+ and the 'requests' library are required to run the PoC and seed scripts.README.md:55-56
  • The lab must be started and the Saleor API must be healthy before running the PoC.README.md:62-65
  • Victim data must be seeded using seed_data.py to have orders with PII to exploit.README.md:44-45scripts/seed_data.py:1-10

Evidence-described exercise path

  1. Start the lab environment using 'docker compose up -d' or the provided setup scripts.README.md:62-63setup_lab.sh:46-47
  2. Wait for the Saleor API to become healthy (healthcheck endpoint responds).README.md:64-65setup_lab.sh:49-56
  3. Create an admin user and populate the database with sample products/channels.README.md:67-72setup_lab.sh:59-70
  4. Run seed_data.py to create victim accounts and draft orders containing PII.README.md:74-77setup_lab.sh:73-75
  5. Execute the PoC script (poc_cve_2026_24136.py) in 'explain', 'file', 'single', or 'enumerate' mode to demonstrate unauthenticated PII exfiltration.README.md:83-100scripts/poc_cve_2026_24136.py:1-12
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the Saleor API container). The PoC sends unauthenticated GraphQL queries to localhost:8000 to read order data, which is the expected exploit demonstration. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions. Port mappings and volume mounts are standard for a local lab.

scripts/poc_cve_2026_24136.py:19-20scripts/poc_cve_2026_24136.py:100-110docker-compose.yml:60-61
Review boundaries

What the analysis did not establish

  • The packet does not include the actual Saleor source code or the patch commit; the vulnerability description relies on the README and PoC script comments.
  • The PoC script's 'enumerate' mode is noted to be ineffective against Saleor 3.x UUID-based IDs, but this is documented in the script itself.
  • No runtime logs or network captures are provided to confirm the exploit behavior.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

5