CVE-2026-63461: Vendure Shop API authorization bypass via filterOperator

CVE-2026-63461 · Severity: medium · CVSS 5.3 · Published 2026-09-17

Vendure is an open-source e-commerce platform that provides a Shop API for customers to browse product catalogs. Due to a logic flaw in filter handling, attackers can query the public Shop API to retrieve products and collections that administrators intended to keep hidden—such as discontinued products or private catalog sections. Since the Shop API requires no authentication, any Internet user can exploit this to gain unauthorized visibility into sensitive catalog information.

Technologies: @vendure/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-63461 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63461 being exploited in the wild.
How severe is CVE-2026-63461?
Medium severity, with a CVSS score of 5.3, published 17 September 2026.
Which products and versions are affected?
@vendure/core (npm) >= 1.0.0, < 3.6.5, SEMVER:introduced=1.0.0,fixed=3.6.5.
Is there a fix for CVE-2026-63461?
Yes. @vendure/core (npm): upgrade to 3.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63461 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63461?
Check whether you run @vendure/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @vendure/core (npm): upgrade to 3.6.5 or later
    npm install @vendure/core@3.6.5

Technical details

The vulnerability exists in the Shop API's `products`, `collections`, and `facets` queries, which inject mandatory authorization filters (e.g., `Product.enabled = true`, `Collection.isPrivate = false`) to restrict visibility to public entities. However, these injected guards are combined with caller-supplied filters using the caller-controlled `filterOperator` parameter. When an attacker sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, allowing attackers to bypass the authorization check by supplying a predicate that matches non-public entities. The attack requires no authentication and is remotely exploitable via GraphQL queries. The fix (version 3.6.5+) ensures the injected guard is always AND-combined with caller-supplied filters, regardless of `filterOperator` value.

Affected products

  • Vendure @vendure/core >=1.0.0, <3.6.5

Identifiers

  • CVE-2026-63461
  • GHSA-xf65-r35x-wmmv

Timeline

  • 2026-07-01: disclosed
  • 2026-09-17: advisory
  • 2026-09-17: patched: version 3.6.5 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.