CVE-2025-58442

Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95
https://github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bb
https://github.com/saleor/saleor/releases/tag/3.21.16
https://github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5

Configurations

No configuration.

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Saleor es una plataforma de comercio electrónico. A partir de la versión 3.21.0 y antes de la versión 3.21.16, solicitar ciertos campos en la respuesta de 'accountRegister' puede resultar en errores que podrían revelar involuntariamente si un usuario con el correo electrónico proporcionado ya existe en Saleor. La versión 3.21.16 corrige el problema. Como solución alternativa, limitar la tasa de la mutación para reducir el impacto.

Information

Published : 2025-09-09 20:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-58442

Mitre link : CVE-2025-58442

CVE.ORG link : CVE-2025-58442

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2025-58442", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58442", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T13:50:34.635633Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "saleor", "product": "saleor", "versions": [{"status": "affected", "version": ">= 3.21.0, < 3.21.16"}]}]}], "published": "2025-09-09T20:15:48.813", "references": [{"url": "https://github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95", "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bb", "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/releases/tag/3.21.16", "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact."}, {"lang": "es", "value": "Saleor es una plataforma de comercio electr\u00f3nico. A partir de la versi\u00f3n 3.21.0 y antes de la versi\u00f3n 3.21.16, solicitar ciertos campos en la respuesta de 'accountRegister' puede resultar en errores que podr\u00edan revelar involuntariamente si un usuario con el correo electr\u00f3nico proporcionado ya existe en Saleor. La versi\u00f3n 3.21.16 corrige el problema. Como soluci\u00f3n alternativa, limitar la tasa de la mutaci\u00f3n para reducir el impacto."}], "lastModified": "2026-10-19T17:10:00.173", "sourceIdentifier": "security-advisories@github.com"}