CVE-2026-63461
MediumCVSS 5.3Summary
In Vendure prior to 3.6.5, public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets.
Risk Assessment
An attacker can access data that should be hidden, such as disabled products or private collections, potentially leading to leakage of business information. The risk affects any Vendure deployment with a public Shop API.
Recommendation
Upgrade Vendure to version 3.6.5 or later. Until patched, consider restricting access to the public Shop API.
Other vulnerabilities in Vendure
See all- CVE-2026-63460High
Vendure prior to 3.6.5 allows an unauthenticated caller to supply a catastrophically backtracking regular expression pattern through StringOperators.regex in the public Shop GraphQL API. Deployments using better-sqlite3 and sqljs evaluate the pattern synchronously in the Node.js event loop, which can block request processing. The issue is fixed in version 3.6.5.
- CVE-2026-63459High
Vendure prior to 3.6.5 contains a stored XSS vulnerability in RichTextDescriptionCell, which assigns an administrator-controlled description to a live element's innerHTML and then reads textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products, Collections, Promotions, Payment Methods, or Shipping Methods lists, and script executes when another administrator views the affected row.
- CVE-2026-67347Medium
A vulnerability in Vendure (up to version 3.7.1) allows channel-scoped administrators to modify other tenants' data by bypassing channel isolation validation. The attack involves supplying global IDs of StockLocation or Asset entities from different channels.
- CVE-2026-63472Critical
In Vendure, the createCustomerAndUser function in external authentication matches an existing customer by email address and attaches a new external authentication method without requiring verification. An attacker can use an unverified email to hijack the victim's account.
Original NVD description (English source)
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.