The requestEmailChange mutation in Saleor produced distinct error messages that exposed whether an email address was registered in the system. This allows an attacker to confirm the existence of user accounts simply by submitting a change‑email request and observing the response. The problem is an information‑exposure weakness (CWE‑204) that can reveal the membership composition of an e‑commerce store, potentially aiding further attacks such as targeted phishing or credential‑reuse attempts.

Saleor e‑commerce platform versions from 2.10.0 up to just before 3.23.0a3, and the specific releases 3.22.47, 3.21.54, and 3.20.118 are susceptible. Users running these builds may experience the enumeration flaw.

The CVSS score is 5.3, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the KEV catalog. An attacker can reach the vulnerable endpoint over the network, submit arbitrary email addresses, and deduce account existence based on differing error messages. The risk is that an enumerated list of user emails can be leveraged for social engineering or other malicious activities.