CVE-2026-67347

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67347
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67347.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67347
Published
2026-07-30T14:40:02Z
Modified
2026-08-15T04:07:07Z
Severity
  • 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update
Details

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67347.json"
}
References

Affected packages

Git / github.com/vendurehq/vendure

Affected ranges

Type
GIT
Repo
https://github.com/vendurehq/vendure
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d968e114f32ad6783f11b2fa95d94f7d1073cb1c
Fixed
f67ef5f621282b785a2708df468bc6d2b8d8115b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.7.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.0-alpha.10
0.1.0-alpha.11
0.1.0-alpha.12
0.1.0-alpha.13
0.1.0-alpha.14
0.1.0-alpha.15
0.1.0-alpha.16
0.1.0-alpha.18
0.1.0-alpha.3
0.1.0-alpha.4
0.1.0-alpha.5
0.1.0-alpha.6
0.1.0-alpha.7
0.1.0-alpha.8
0.1.0-alpha.9
v0.*
v0.1.2-beta.0
v0.1.2-beta.1
v0.1.2-beta.10
v0.1.2-beta.11
v0.1.2-beta.12
v0.1.2-beta.2
v0.1.2-beta.3
v0.1.2-beta.4
v0.1.2-beta.5
v0.1.2-beta.6
v0.1.2-beta.7
v0.1.2-beta.8
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.1
v0.12.2
v0.12.3
v0.12.4
v0.13.0
v0.15.0
v0.15.1
v0.15.2
v0.16.0
v0.16.1
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.3.3
v0.3.4
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.6.2
v0.6.4
v0.6.5
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v1.*
v1.0.0
v1.0.0-beta.1
v1.0.0-beta.10
v1.0.0-beta.11
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.0-beta.8
v1.0.0-beta.9
v1.0.0-rc.0
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.0-beta.0
v2.*
v2.0.0
v2.0.0-beta.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3
v2.0.0-next.0
v2.0.0-next.1
v2.0.0-next.10
v2.0.0-next.11
v2.0.0-next.12
v2.0.0-next.13
v2.0.0-next.14
v2.0.0-next.15
v2.0.0-next.16
v2.0.0-next.17
v2.0.0-next.18
v2.0.0-next.19
v2.0.0-next.2
v2.0.0-next.20
v2.0.0-next.21
v2.0.0-next.22
v2.0.0-next.23
v2.0.0-next.24
v2.0.0-next.25
v2.0.0-next.26
v2.0.0-next.27
v2.0.0-next.28
v2.0.0-next.3
v2.0.0-next.4
v2.0.0-next.5
v2.0.0-next.6
v2.0.0-next.7
v2.0.0-next.8
v2.0.0-next.9
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.0-next.5
v2.1.0-next.6
v2.1.0-next.7
v2.2.0
v2.2.0-next.0
v2.2.0-next.1
v2.2.0-next.2
v2.2.0-next.3
v2.2.0-next.4
v2.2.0-next.5
v2.2.0-next.6
v2.2.0-next.7
v2.2.0-next.8
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.3.0
v3.*
v3.0.0
v3.0.0-next.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.2.0
v3.2.1
v3.2.2
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.4.0
v3.4.1
v3.4.2
v3.5.0
v3.7.0
v3.7.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67347.json"