CVE-2020-7964

5.3 mediumEPSS 1.1%

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2020-01-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mirumee:saleor

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rgcm-rpq9-9cgr	PyPI	saleor	>=2.0.0 <2.9.1	2.9.1
PYSEC-2026-747	PyPI	saleor	>=2.0.0 <2.9.1	2.9.1

References

https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3
https://github.com/mirumee/saleor/releases/tag/2.9.1
https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3
https://github.com/mirumee/saleor/releases/tag/2.9.1

Check your stack JSON