How severe is CVE-2022-39275?

CVE-2022-39275 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2022-39275 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-39275?

CVE-2022-39275 affects Saleor. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-39275?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-39275 published?

CVE-2022-39275 was published on 2022-10-06 and last updated on 2026-06-17.

CVE-2022-39275

CVE-2022-39275 is a medium-severity vulnerability in Saleor with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 1% (40th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-20
Affected product: Saleor
Published: 2022-10-06
Last modified: 2026-06-17

Description

Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the `assignNavigation()` mutation. This issue has been patched in main and backported to multiple releases (3.7.17, 3.6.18, 3.5.23, 3.4.24, 3.3.26, 3.2.14, 3.1.24). Users are advised to upgrade. There are no known workarounds for this issue.

Frequently asked questions

What is CVE-2022-39275?: Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the `assignNavigation()` mutation. This issue has been patched in main and backported to multiple releases (3.7.17, 3.6.18, 3.5.23, 3.4.24, 3.3.26, 3.2.14, 3.1.24). Users are advised to upgrade. There are no known workarounds for this issue.
How severe is CVE-2022-39275?: CVE-2022-39275 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2022-39275 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-39275?: CVE-2022-39275 affects Saleor. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-39275?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-39275 published?: CVE-2022-39275 was published on 2022-10-06 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*

More vulnerabilities in Saleor

CVE-2026-35401 — High (CVSS 7.5): Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can…
CVE-2026-33756 — High (CVSS 7.5): Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query…
CVE-2026-24136 — High (CVSS 7.5): Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through…
CVE-2026-35407 — Medium (CVSS 6.5): Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and…
CVE-2023-26051 — Medium (CVSS 6.5): Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python…
CVE-2022-0932 — Medium (CVSS 6.5): Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.

All CVEs affecting Saleor →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →