# CVE-2026-67347: Vendure cross-channel authorization bypass in StockLocation and Asset services

Source: https://junglewise.ai/threats/cve-2026-67347-vendure-cross-channel-authorization-bypass-in-stocklocation-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-67347 · Severity: medium · CVSS 6.8 · Published 2026-07-30

Vendure, an open-source e-commerce framework, contains a security flaw that allows administrators of one store (channel) to modify data belonging to other stores on the same platform. Specifically, an attacker with administrative access to their own store could overwrite inventory locations or catalog assets belonging to other tenants. This could lead to unauthorized data modification and operational disruption across a multi-tenant environment.

## Quick answers

**Is CVE-2026-67347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67347 being exploited in the wild.

**How severe is CVE-2026-67347?** Medium severity, with a CVSS score of 6.8, published 30 July 2026.

**Which products and versions are affected?** Vendure <= 3.7.1.

**Is there a fix for CVE-2026-67347?** A patch was published on 2026-07-28: Fix committed to core repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67347 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67347?** Check whether you run Vendure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-channel authorization bypass vulnerability exists in Vendure's stock-location.service.ts and asset.service.ts. The root cause is the use of the getEntityOrThrow() method without passing a channelId guard, which fails to enforce proper isolation between different tenants (channels). An attacker with 'channel-scoped' administrator privileges can provide global IDs for StockLocation or Asset entities belonging to other channels to successfully execute update operations. This allows for unauthorized modification of inventory locations and catalog assets. The issue was fixed in commit f67ef5f by adding the required channel-scope validation.

## Affected products

- Vendure Vendure <= 3.7.1

## Timeline

- 2026-07-28: patched: Fix committed to core repository
- 2026-07-30: disclosed: Vulnerability published via NVD and VulnCheck

## References

- [https://github.com/vendurehq/vendure/commit/f67ef5f621282b785a2708df468bc6d2b8d8115b](https://github.com/vendurehq/vendure/commit/f67ef5f621282b785a2708df468bc6d2b8d8115b)
- [https://github.com/vendurehq/vendure/issues/5003](https://github.com/vendurehq/vendure/issues/5003)
- [https://github.com/vendurehq/vendure/pull/5017](https://github.com/vendurehq/vendure/pull/5017)
- [https://www.vulncheck.com/advisories/vendure-cross-channel-authorization-bypass-via-stocklocation-and-asset-update](https://www.vulncheck.com/advisories/vendure-cross-channel-authorization-bypass-via-stocklocation-and-asset-update)

## Related threats

- [Vendure account takeover in external authentication](https://junglewise.ai/threats/cve-2026-63472-vendure-account-takeover-in-external-authentication)