Saleor’s account activation process incorrectly treats email verification as full proof of ownership, allowing attackers to create an account with a target’s email address before the victim registers. When the victim follows the activation link, the platform merges the attacker’s anonymous shopping cart and gift‑card data into the newly activated account without requiring the victim’s password. This results in the attacker gaining access to the victim’s order history, personal details, and any other data stored in anonymous commerce objects.

The vendor is Saleor, the open‑source e‑commerce platform. Versions impacted include any release from 2.10.0rc1 up to and including 3.21.67, 3.22.63, and 3.23.22. The vulnerability has been fixed in these patch releases, and the newer 3.24.0 version redesigns the activation flow to require password confirmation before linking anonymous objects.

The CVSS score of 8.1 indicates a high‑severity vulnerability, and although an EPSS score is not available, the known exploitation route—creating an account with a victim’s email and leveraging the email‑verification link—is straightforward and does not require elevated privileges. The issue is not listed in the CISA KEV catalog, but its potential for data theft and account compromise makes it a high‑priority target for attackers. Exploitability hinges on the victim engaging with the activation link, meaning that targeted phishing or social engineering can line up the attacker’s actions for the merge to occur.