Medium severity5.3OSV Advisory· Published Sep 9, 2025· Updated Apr 15, 2026

CVE-2025-58442

Description

Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of accountRegister may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Saleor/SaleorOSV2 versions
2.0.0, 2.1.0, 2.10.0, …+ 1 more
- (no CPE)range: 2.0.0, 2.1.0, 2.10.0, …
- (no CPE)range: >=3.21.0 <3.21.16

Patches

Vulnerability mechanics

References

github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95nvd
github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bbnvd
github.com/saleor/saleor/releases/tag/3.21.16nvd
github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000