EUVD-2026-81669
GHSA-xf65-r35x-wmmv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Public unauthenticated GraphQL API reachable over network (AV:N/PR:N/UI:N), trivial query (AC:L), disclosure-only of catalog metadata (C:L, I:N, A:N), no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.
AnalysisAI
Unauthenticated attackers can retrieve hidden catalog entities from Vendure's publicly accessible Shop API by setting the filterOperator argument to OR, which causes the mandatory visibility guard to be OR-combined with the caller's own filters instead of AND-combined. The flaw affects the npm package @vendure/core in all versions from 1.0.0 up to (but not including) 3.6.5 and exposes disabled products and private collections or facets through the products, collections, and facets list queries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond default deployment - the Vendure Shop API is publicly accessible and unauthenticated by design, and the vulnerable filterOperator:OR handling is present in the default query resolvers for products, collections, and facets across all versions >=1.0.0 and <3.6.5. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which is internally consistent with the vendor advisory: the Shop API is publicly reachable over the network, requires no authentication (PR:N), no user interaction, and the impact is confined to unauthorized disclosure of catalog metadata (C:L, I:N, A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading @vendure/core to version 3.6.5 or later (release tag: https://github.com/vendurehq/vendure/releases/tag/v3.6.5; advisory: https://github.com/vendurehq/vendure/security/advisories/GHSA-xf65-r35x-wmmv), then rebuild and redeploy - the fix makes the injected visibility guard always AND-combined with caller filters irrespective of filterOperator (commit 6daf5cb8571321eb6c6afa1d8e95a390c060be02). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in the Vendure Admin Dashboard (@vendure/dashboard prior to 3.6.5) lets an authenticated, lo
Unauthenticated denial of service in Vendure (open-source headless commerce platform) versions up to and including 3.6.4
Cross-channel authorization bypass in Vendure through 3.7.1 allows a low-privileged, channel-scoped administrator to ove
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog pe
Account takeover in Vendure (@vendure/core) prior to 3.7.0 allows an attacker to bind their own external OAuth/social id
Vendure versions up to 3.5.3 contains a vulnerability that allows attackers to enumerate valid usernames (email addresse
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today