Read the docs
TI-2026-47643 Aliases CVE-2026-67347GHSA-327h-gp7q-mxcj

Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Priority MEDIUM 60CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00511 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vendurehqvendureup to 3.7.1—Patch availableCNA
  • vendure Vendorvendurehq Affected up to 3.7.1 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67347
  2. 2026-10-03 Alias added: GHSA-327h-gp7q-mxcj

References

Exploit 1

Patch 2

  • TI-2026-45233 Improper authentication in vendurehq vendure CVSS 3.1CRITICAL 9.1
  • TI-2026-45227 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions CVSS 3.1HIGH 8.7
  • TI-2026-45228 Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends CVSS 3.1HIGH 7.5
  • TI-2026-29543 @vendure/core has a SQL Injection vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2026-45229 Vendure: Shop API list queries can return non-public entities when filterOperator is OR CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences