Executive brief
Vendure is an open-source e-commerce platform that provides a Shop API for customers to browse product catalogs. Due to a logic flaw in filter handling, attackers can query the public Shop API to retrieve products and collections that administrators intended to keep hidden—such as discontinued products or private catalog sections. Since the Shop API requires no authentication, any Internet user can exploit this to gain unauthorized visibility into sensitive catalog information.
Technical details
The vulnerability exists in the Shop API's `products`, `collections`, and `facets` queries, which inject mandatory authorization filters (e.g., `Product.enabled = true`, `Collection.isPrivate = false`) to restrict visibility to public entities. However, these injected guards are combined with caller-supplied filters using the caller-controlled `filterOperator` parameter. When an attacker sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, allowing attackers to bypass the authorization check by supplying a predicate that matches non-public entities. The attack requires no authentication and is remotely exploitable via GraphQL queries. The fix (version 3.6.5+) ensures the injected guard is always AND-combined with caller-supplied filters, regardless of `filterOperator` value.
Affected products
- Vendure @vendure/core >=1.0.0, <3.6.5
Timeline
- 2026-07-01: disclosed
- 2026-09-17: advisory
- 2026-09-17: patched: version 3.6.5 released
References
- https://api.github.com/users/pavelkohout396
- https://github.com/pavelkohout396
- https://api.github.com/users/pavelkohout396/gists%7B/gist_id%7D
- https://api.github.com/users/pavelkohout396/repos
- https://avatars.githubusercontent.com/u/192136750?v=4
- https://api.github.com/users/pavelkohout396/events%7B/privacy%7D