Home / ECOMMERCE / Saleor / 3.21.67
Saleor 3.21.67stable Released Jul 27, 2026
Impact Score: 5/10

Saleor 3.21.67 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: saleor · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes
📄 .MD
✨ Features 1 🔧 Bug Fixes 2
⚡ Executive Summary (TL;DR)

Saleor 3.21.67. Source highlight: Fixed CVE-2026-44472 - Account pre-hijacking vulnerability due to unverified anonymous order merge

Visit Saleor Official Site ↗ Official Release Source ↗ All Saleor Releases 📡 Saleor RSS
Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

✨ New Features & Capabilities (1)

  • tests: add missing test for old_id when fetching orders

🔧 Bug Fixes & Patches (2)

  • Fixed CVE-2026-44472 - Account pre-hijacking vulnerability due to unverified anonymous order merge
  • Fixed CVE-2026-48744 - Anonymous users can bypass authorization checks in selected GraphQL paths
📄 View Raw Release Notes (Original Developer Log)
## What's Changed Changes: - Fixed [CVE-2026-44472](https://github.com/saleor/saleor/security/advisories/GHSA-6whj-8p3f-2xqp) - Account pre-hijacking vulnerability due to unverified anonymous order merge by @NyanKiyoshi in https://github.com/saleor/saleor/commit/dc63e422afc9f6ce115d75f045886b01b4f13e2b - Fixed [CVE-2026-48744](https://github.com/saleor/saleor/security/advisories/GHSA-xqqq-qhgq-gx53) - Anonymous users can bypass authorization checks in selected GraphQL paths by @NyanKiyoshi in https://github.com/saleor/saleor/commit/11efb4e9ea76942cf142bc01de8846cbaf764465 - tests: add missing test for old_id when fetching orders by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19538 Thanks to @0xSmiley and @pavelkohout396 for reporting the issues! > [!NOTE] > Make sure to follow our [upgrade guide](https://docs.saleor.io/upgrade-guides/core/migrate-account-merging) if you use the `confirmAccount()` mutation (CVE-2026-44472). **Full Changelog**: https://github.com/saleor/saleor/compare/3.21.66...3.21.67
← Older Version Saleor 3.23.21