Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Saleor throttling.py get_client_ip excessive authentication

CVSS 4.0 6.3 MEDIUMCVSS 3.1 3.7 LOWCVSS 3.0 3.7 LOWCVSS 2.0 2.6 Check source for fixed versionsKEV status unknown

cve-program · CVE-2026-93650

Published

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93650

Published

Saleor

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "n/a",
                    "product": "Saleor",
                    "versions": [
                        {
                            "version": "3.20.118",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.0",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.1",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.2",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.3",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.4",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.5",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.6",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.7",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.8",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.9",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.10",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.11",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.12",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.13",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.14",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.15",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.16",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.17",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.18",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.19",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.20",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.21",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.22",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.23",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.24",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.25",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.26",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.27",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.28",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.29",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.30",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.31",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.32",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.33",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.34",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.35",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.36",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.37",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.38",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.39",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.40",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.41",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.42",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.43",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.44",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.45",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.46",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.47",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.48",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.49",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.50",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.51",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.52",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.53",
                            "status": "affected"
                        },
                        {
                            "version": "3.21.54",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.0",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.1",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.2",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.3",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.4",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.5",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.6",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.7",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.8",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.9",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.10",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.11",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.12",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.13",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.14",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.15",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.16",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.17",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.18",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.19",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.20",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.21",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.22",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.23",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.24",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.25",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.26",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.27",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.28",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.29",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.30",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.31",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.32",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.33",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.34",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.35",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.36",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.37",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.38",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.39",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.40",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.41",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.42",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.43",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.44",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.45",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.46",
                            "status": "affected"
                        },
                        {
                            "version": "3.22.47",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.0",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.1",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.2",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.3",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.4",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.5",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.6",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.7",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.8",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.9",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.10",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.11",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.12",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.13",
                            "status": "affected"
                        },
                        {
                            "version": "3.23.14",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 03:01 UTC · 274 of 275 readable · 272 fully read · documentation 469/469 current