A business-logic and authorization defect in Saleor’s account-email-change workflow allows a token generated for one user to be applied while logged in as a different user. Because the confirmation token is not verified against the currently authenticated account, the second account’s email address is overwritten with the new_email value from the token. This results in an unauthorized change of a user’s email address, potentially disrupting account recovery or notification processes; this consequence is inferred from the nature of the change.

The vulnerability affects Saleor e-commerce platform versions starting from 2.10.0 up to, but not including, 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118. Versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118 contain the fix and later releases inherit the patch.

The CVSS score of 5.9 indicates a moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. An attacker must possess a valid email-change confirmation token for one account and be authenticated as a different account to exploit the flaw. The attack can be carried out through the normal account-management interface, making it a relatively straightforward authenticated privilege escalation within the platform.