A broken authorization check in the permission utilities of Saleor allows callers without valid login credentials to execute the channelUpdate mutation, thereby altering vital channel order settings such as allowUnpaidOrders. In addition, the same flaw exposes otherwise hidden objects in pageType and translation queries, potentially leaking sensitive configuration details. The weakness is an example of improper privilege enforcement (CWE-285) and would let an attacker tamper with store logic without authentication.

The flaw affects the Saleor e‑commerce platform, specifically versions 3.14.67 up to 3.21.67, 3.22.63, and 3.23.22. All installations running any of these releases are susceptible unless the source code has been otherwise patched.

The CVSS base score of 6.5 indicates a medium severity that can be achieved by an unauthenticated attacker over a GraphQL endpoint. The exploitation path requires no prior access and can be performed remotely, making the attack feasible but limited to the stated API surface. The vulnerability is not yet listed in CISA KEV and EPSS data is unavailable, so the current likelihood of exploitation is uncertain but mitigable through the recommended patches.