Saleor 3.22.63 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: saleor · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

✨ Features 1 🔧 Bug Fixes 2

⚡ Executive Summary (TL;DR)

Saleor 3.22.63. Source highlight: Fixed CVE-2026-44472 - Account pre-hijacking vulnerability due to unverified anonymous order merge

Visit Saleor Official Site ↗ Official Release Source ↗ All Saleor Releases 📡 Saleor RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

✨ New Features & Capabilities (1)

tests: add missing test for old_id when fetching orders

🔧 Bug Fixes & Patches (2)

Fixed CVE-2026-44472 - Account pre-hijacking vulnerability due to unverified anonymous order merge
Fixed CVE-2026-48744 - Anonymous users can bypass authorization checks in selected GraphQL paths

📄 View Raw Release Notes (Original Developer Log)

## What's Changed Changes: - Fixed [CVE-2026-44472](https://github.com/saleor/saleor/security/advisories/GHSA-6whj-8p3f-2xqp) - Account pre-hijacking vulnerability due to unverified anonymous order merge by @NyanKiyoshi in https://github.com/saleor/saleor/commit/299cdfb1a5737108b78b5c2c0d29b94f3b7331a2 - Fixed [CVE-2026-48744](https://github.com/saleor/saleor/security/advisories/GHSA-xqqq-qhgq-gx53) - Anonymous users can bypass authorization checks in selected GraphQL paths by @NyanKiyoshi in https://github.com/saleor/saleor/commit/9b1f59b3ed86c3fad3ce071639cf434c1ab94a85 - tests: add missing test for old_id when fetching orders by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19539 Thanks to @0xSmiley and @pavelkohout396 for reporting the issues! > [!NOTE] > Make sure to follow our [upgrade guide](https://docs.saleor.io/upgrade-guides/core/migrate-account-merging) if you use the `confirmAccount()` mutation (CVE-2026-44472). **Full Changelog**: https://github.com/saleor/saleor/compare/3.22.62...3.22.63

← Older Version Saleor 3.21.67 Newer Version → Saleor 3.23.22