How to use this reference
Editorial lesson: a valid confirmation artifact should authorize one subject, one operation and an expected current state. The linked patch adds subject and operation checks plus agreement with the account's prior email state. Its confirmation tests cover cross-account rejection and changed-state handling. Reading those checks and assertions does not establish a successful test run. Review identity transitions as a complete authorization contract rather than treating token validity as sufficient permission.
Before reading
- Authenticated sessions, confirmation tokens and account lifecycle concepts
- Authorization invariants across business-state transitions
Context and limits
- The advisory lists branch fixes 3.23.0a3, 3.22.47, 3.21.54 and 3.20.118. Its affected entries each start at 2.10.0 and end before the corresponding fix; retain these branch contexts rather than collapsing them into one interval. 3.23.0a3 is a prerelease.
- Maintainers list no known workaround. Historical patched versions are not a guarantee of current security across all issues.
- The reviewed sources do not establish a controlled independent demonstration or a production incident. Durable account compromise remains maintainer-described potential impact, conditional on the stated authenticated-access prerequisite.
- NyanKiyoshi published the advisory; ch1nhpd is credited as Reporter. No narrative byline or qualifying individual award is established.
- The linked commit bundles other security changes. Only its email-confirmation binding and related tests support this case; unrelated changes are not attributed to CVE-2026-35407. Commit and software-release dates were not established.
- The confirmation operation's subject, purpose and current-state contract is distinct from the library's external-identity issuer and account-linking examples. Learning prerequisites and generalized defensive guidance are editorial.
Sources and provenance
- Cross-Account Email Change via Unbound Confirmation Token Saleor maintainers · reviewed 2026-10-06
- Saleor main-branch security patch containing email-confirmation checks Saleor maintainers · reviewed 2026-10-06
- Saleor email-confirmation tests at the linked fix commit Saleor maintainers · reviewed 2026-10-06
Record reviewed 2026-10-06. Snapshot cb017eaea66e. Open the complete JSON contract.