Vendure CVE-2026-67347

Exploitation requires the attacker to hold a valid, authenticated channel-scoped administrator account on the Vendure instance (PR:L - low privilege, not unauthenticated). The Vendure deployment must operate in multi-channel mode with at least two distinct channels configured - the AT:P attack requirement in the CVSS 4.0 vector reflects this architectural prerequisite, and single-channel deployments are not exposed to cross-tenant data tampering. The attacker must additionally be able to obtain or enumerate a global entity ID belonging to a different channel; sequential IDs reduce the difficulty of this step. Exploitation is fully remote over the network and requires no user interaction. The flaw does not yield confidentiality access (VC:N) - impact is limited to overwriting or corrupting another tenant's StockLocation inventory records and Asset catalog entries (VI:H, VA:H). Administrator account compromise or a malicious insider with channel-admin credentials is the realistic threat actor.

The CVSS 4.0 base score of 6.1 is a measured but potentially underweighted signal for multi-tenant Vendure operators. The PR:L requirement means exploitation demands a legitimately authenticated channel-scoped admin account - this materially limits the threat surface compared to unauthenticated flaws. The AT:P modifier correctly captures that multi-channel deployment mode is a prerequisite; single-channel instances are unaffected. However, the combination of a publicly available exploit (GitHub issue #5003), high integrity impact (VI:H - arbitrary overwrite of another tenant's inventory and catalog data), and high availability impact (VA:H - corruption of stock location and asset records can disrupt order fulfillment and storefront operations) elevates real-world urgency beyond the moderate score. No CISA KEV listing is present and no EPSS data was provided, so exploitation breadth cannot be quantified; the threat appears opportunistic or insider-driven rather than mass-exploited. For SaaS operators running Vendure in multi-tenant mode, this is a genuine priority. For single-channel deployments, urgency is low. No CVSS 3.1 vector was provided in the input - the score of 6.1 corresponds to the CVSS 4.0 vector only.

A channel-scoped administrator for Channel B in a multi-tenant Vendure deployment authenticates to the Admin GraphQL API and enumerates or guesses the global integer or UUID ID of a StockLocation or Asset belonging to Channel A. The attacker submits an updateStockLocation or updateAsset mutation referencing that cross-channel ID - because the update method performs no channel-scoped ownership check, the mutation succeeds and overwrites the target tenant's inventory location name, description, or asset metadata without any authorization error. A public proof-of-concept demonstrating this cross-tenant overwrite is available at https://github.com/vendurehq/vendure/issues/5003.