CVE-2019-13594: Mirumee Saleor

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.

Affected products

• Mirumee Saleor: version 2.7.0 only

Published 2019-07-14. Last modified 2026-06-17.