Read the docs
TI-2026-45229 Aliases CVE-2026-63461GHSA-xf65-r35x-wmmv

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Fixed vendure (vendurehq): 3.6.5@vendure/core (npm): 3.6.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vendurehqvendure1.0.0 to before 3.6.53.6.5Patch availableCNA
—@vendure/core (npm)1.0.0 to before 3.6.53.6.5Patch availableGHSA-xf65-r35x-wmmv
  • vendure Vendorvendurehq Affected 1.0.0 to before 3.6.5 Fixed in 3.6.5 Patch available CNA
  • @vendure/core (npm) Vendor— Affected 1.0.0 to before 3.6.5 Fixed in 3.6.5 Patch available GHSA-xf65-r35x-wmmv

Remediation

  • Fix · CNA vendure (vendurehq) Fixed in 3.6.5
  • Fix · GHSA-xf65-r35x-wmmv @vendure/core (npm) Fixed in 3.6.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63461
  2. 2026-10-03 Alias added: GHSA-xf65-r35x-wmmv

References

Other 4

  • TI-2026-45233 Improper authentication in vendurehq vendure CVSS 3.1CRITICAL 9.1
  • TI-2026-45227 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions CVSS 3.1HIGH 8.7
  • TI-2026-45228 Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends CVSS 3.1HIGH 7.5
  • TI-2026-47643 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update CVSS 4.0MEDIUM 6.1
  • TI-2026-29543 @vendure/core has a SQL Injection vulnerability CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences