Skip to content
OpenAdvisories

Vendor

vendurehq

7 known vulnerabilities.

Products

vendure 7
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-63461

    Vendure: Shop API list queries can return non-public entities when filterOperator is OR

    Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperato…

    vendurehq vendure @vendure/core npm
  • Medium 6.8
    CVE-2026-67347

    Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

    Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can…

    vendurehq vendure