---
id: CVE-2020-7964
aliases:
  - GHSA-rgcm-rpq9-9cgr
  - PYSEC-2026-747
title: Missing Authentication for Critical Function in Saleor
summary: Missing Authentication for Critical Function in Saleor
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: saleor
product: saleor
ecosystem: pip
affected:
  - 'saleor >= 2.0.0, < 2.9.1'
patched:
  - saleor 2.9.1
published: '2021-07-28'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rgcm-rpq9-9cgr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-7964'
  - url: >-
      https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3
  - url: 'https://github.com/mirumee/saleor/releases/tag/2.9.1'
tags:
  - osv
  - pip
epss: 0.01092
epssPercentile: 0.63511
ingestedAt: '2026-07-08T18:25:52.717Z'
---

## Overview

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

## Affected packages

- `saleor >= 2.0.0, < 2.9.1`

## Remediation

Upgrade to a patched release:

- `saleor 2.9.1`