CVE-2026-63461

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63461
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63461.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63461
Aliases
Published
2026-09-17T14:43:01Z
Modified
2026-09-19T03:47:21Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Details

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63461.json"
}
References

Affected packages

Git / github.com/vendurehq/vendure

Affected ranges

Type
GIT
Repo
https://github.com/vendurehq/vendure
Events
Introduced
033fb5785e8d23dab5c0002f4e6e95d502da3caf
Fixed
6daf5cb8571321eb6c6afa1d8e95a390c060be02
Fixed
ceb0705be869c1b84f6796c8e7bdc56faa33c064
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.0.0"
        },
        {
            "fixed":  "3.6.5"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.0-beta.0
v2.*
v2.0.0
v2.0.0-beta.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3
v2.0.0-next.0
v2.0.0-next.1
v2.0.0-next.10
v2.0.0-next.11
v2.0.0-next.12
v2.0.0-next.13
v2.0.0-next.14
v2.0.0-next.15
v2.0.0-next.16
v2.0.0-next.17
v2.0.0-next.18
v2.0.0-next.19
v2.0.0-next.2
v2.0.0-next.20
v2.0.0-next.21
v2.0.0-next.22
v2.0.0-next.23
v2.0.0-next.24
v2.0.0-next.25
v2.0.0-next.26
v2.0.0-next.27
v2.0.0-next.28
v2.0.0-next.3
v2.0.0-next.4
v2.0.0-next.5
v2.0.0-next.6
v2.0.0-next.7
v2.0.0-next.8
v2.0.0-next.9
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.0-next.5
v2.1.0-next.6
v2.1.0-next.7
v2.2.0
v2.2.0-next.0
v2.2.0-next.1
v2.2.0-next.2
v2.2.0-next.3
v2.2.0-next.4
v2.2.0-next.5
v2.2.0-next.6
v2.2.0-next.7
v2.2.0-next.8
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.3.0
v3.*
v3.0.0
v3.0.0-next.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.2.0
v3.2.1
v3.2.2
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.4.0
v3.4.1
v3.4.2
v3.5.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63461.json"