Executive brief
Vendure, an open-source e-commerce framework, contains a security flaw that allows administrators of one store (channel) to modify data belonging to other stores on the same platform. Specifically, an attacker with administrative access to their own store could overwrite inventory locations or catalog assets belonging to other tenants. This could lead to unauthorized data modification and operational disruption across a multi-tenant environment.
Technical details
A cross-channel authorization bypass vulnerability exists in Vendure's stock-location.service.ts and asset.service.ts. The root cause is the use of the getEntityOrThrow() method without passing a channelId guard, which fails to enforce proper isolation between different tenants (channels). An attacker with 'channel-scoped' administrator privileges can provide global IDs for StockLocation or Asset entities belonging to other channels to successfully execute update operations. This allows for unauthorized modification of inventory locations and catalog assets. The issue was fixed in commit f67ef5f by adding the required channel-scope validation.
Affected products
- Vendure Vendure <= 3.7.1
Timeline
- 2026-07-28: patched: Fix committed to core repository
- 2026-07-30: disclosed: Vulnerability published via NVD and VulnCheck