Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-29036 Details

Description

Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/saleor/auth-sdk/commit/56db13407aa35d00b85ec2df042692edd4aea9da	CVE	Patch
https://github.com/saleor/saleor-docs/pull/1120	CVE	Issue Tracking
https://github.com/saleor/storefront/commit/579241e75a5eb332ccf26e0bcdd54befa33f4783	CVE	Patch
https://github.com/saleor/storefront/security/advisories/GHSA-52cq-c7x7-cqw4	CVE	Vendor Advisory
https://github.com/saleor/auth-sdk/commit/56db13407aa35d00b85ec2df042692edd4aea9da	[email protected]	Patch
https://github.com/saleor/saleor-docs/pull/1120	[email protected]	Issue Tracking
https://github.com/saleor/storefront/commit/579241e75a5eb332ccf26e0bcdd54befa33f4783	[email protected]	Patch
https://github.com/saleor/storefront/security/advisories/GHSA-52cq-c7x7-cqw4	[email protected]	Vendor Advisory

see all 8 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	[email protected]

Affected Products

Product	Versions
saleor react-storefront	< 1.0.2
CPE cpe:2.3:a:saleor:react-storefront:::::::: Remediation No remediation found in references.

Change History

6 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Dec 3, 2025	Initial Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Mar 20, 2024	New CVE Received	[email protected]