CVE-2026-39851

BRIEFING NOTE: CVE-2026-39851 OVERVIEW CVE-2026-39851 is an information disclosure vulnerability affecting Saleor, a widely-used e-commerce platform. Versions 2.10.0 through 3.22.x and earlier 3.21.x releases contain a flaw in the requestEmailChange() mutation that inadvertently exposes the existence of user-provided email addresses through error messages. This affects all releases before versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, which have issued fixes for this issue. SEVERITY The vulnerability carries a CVSS 3.1 score of 4.3 (Medium) with a network-based attack vector requiring low complexity and valid user authentication. The attack has limited scope, affecting only the confidentiality of email address information with no impact to system integrity or availability. The FAUCET Risk Score of 38.0/100 indicates a relatively low overall risk profile compared to the broader vulnerability landscape. EXPLOITATION STATUS No evidence of active exploitation exists at this time. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, nor is it featured on active threat tracking lists. Community attention remains minimal based on available metrics, suggesting limited real-world exploitation attempts. Organizations should nonetheless prioritize patching affected Saleor instances as part of regular maintenance cycles.