GitHub Advisoryadvisory · npm

GHSA-xf65-r35x-wmmv Vendure: Shop API list queries can return non-public entities when filterOperator is OR

MEDIUM Published 2026-09-17 Modified 2026-09-17 Official page ↗
Aliases
CVE-2026-63461
Ecosystem
npm
Packages
@vendure/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2026-09-17

Affected packages

• npm @vendure/core: >= 1.0.0, < 3.6.5 → fixed in 3.6.5

Description

The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combined with the caller-supplied filter using the caller-controlled `filterOperator`. When a caller sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them. Impact Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required. Patches The injected guard is now always AND-combined with the caller-supplied filter, regardless of `filterOperator`. Workarounds None other than upgrading.

Related

Alias · CVE (1)

  • CVE-2026-63461 Vendure is an open-source headless commerce platform. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References