GHSA-xf65-r35x-wmmv

Source

https://github.com/advisories/GHSA-xf65-r35x-wmmv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-xf65-r35x-wmmv/GHSA-xf65-r35x-wmmv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xf65-r35x-wmmv

Aliases

CVE-2026-63461

Published

2026-09-17T14:50:02Z

Modified

2026-09-17T15:00:05Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

Details

The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false). This injected guard was combined with the caller-supplied filter using the caller-controlled filterOperator. When a caller sets filterOperator: OR, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.

Impact

Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.

Patches

The injected guard is now always AND-combined with the caller-supplied filter, regardless of filterOperator.

Workarounds

None other than upgrading.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-17T14:50:02Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / @vendure/core

Package

Name: @vendure/core; View open source insights on deps.dev
Purl: pkg:npm/%40vendure/core

Affected ranges

Type: SEMVER
Events: Introduced

1.0.0

Fixed

3.6.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-xf65-r35x-wmmv/GHSA-xf65-r35x-wmmv.json"