Is there a public PoC exploit available for EUVD-2026-51150?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51150. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-51150?

Yes, a patch is available for EUVD-2026-51150. Update the affected software to the latest version immediately.

Vendure EUVD-2026-51150

Q: What is the CVSS score of EUVD-2026-51150?

EUVD-2026-51150 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-67347 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-30 VulnCheck

GHSA-327h-gp7q-mxcj

Authentication Bypass Vendure

6.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

PR:L reflects required channel-admin authentication; S:U because all impact stays within Vendure's own data layer; C:N confirmed by VC:N in source vector; I:H and A:H reflect full arbitrary overwrite of cross-tenant inventory and catalog records.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 30, 2026 - 15:33 vuln.today

Analysis Generated

Jul 30, 2026 - 15:33 vuln.today

CVE Published

Jul 30, 2026 - 14:40 cve.org

MEDIUM 6.1

DescriptionCVE.org

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.

AnalysisAI

Cross-channel authorization bypass in Vendure through 3.7.1 allows a low-privileged, channel-scoped administrator to overwrite StockLocation inventory records and Asset catalog entries belonging to other tenants by submitting global GraphQL entity IDs that their channel does not own. The flaw is in the update methods of stock-location.service.ts and asset.service.ts, which omit the required channelId filter during entity lookup, permitting cross-tenant data corruption without triggering any authorization error. A public proof-of-concept exists via GitHub issue #5003, and an upstream fix is available in commit f67ef5f via PR #5017, though a tagged release version incorporating the fix has not been independently confirmed.

Technical ContextAI

Vendure is a headless e-commerce framework built on Node.js and TypeScript that supports multi-channel and multi-tenant deployments. Each channel isolates merchants or storefronts with channel-scoped administrator accounts. The root cause is CWE-863 (Incorrect Authorization): the update() methods in asset.service.ts and stock-location.service.ts accept global GraphQL entity IDs without scoping the database lookup to the requesting administrator's channel context (the missing { channelId: ctx.channelId } filter). As confirmed by the PR #5017 diff, the fix enforces channel-scoped lookups so that cross-channel entity IDs resolve to 'No [Entity] with the id X could be found,' preventing unauthorized overwrites. All versions of the @vendure/core package through 3.7.1 are affected per CPE cpe:2.3:a:vendurehq:vendure:*:*:*:*:*:*:*:*. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) with VI:H and VA:H reflects network-reachable exploitation with high integrity and availability impact on the vulnerable system's data.

RemediationAI

The primary fix is to apply upstream commit f67ef5f (https://github.com/vendurehq/vendure/commit/f67ef5f621282b785a2708df468bc6d2b8d8115b) from PR #5017 (https://github.com/vendurehq/vendure/pull/5017). Operators running self-hosted Vendure should update to a release that includes this commit - since an exact tagged release version is not confirmed, verify that the installed @vendure/core package includes the channelId-scoped lookup guard in asset.service.ts and stock-location.service.ts before considering the system remediated. If immediate patching is not feasible, restrict channel-scoped administrator accounts to only fully trusted internal personnel to reduce the attacker pool; note this is a policy control only and does not eliminate the technical flaw. Operators running Vendure in single-channel mode with no multi-tenant configuration are not exposed to cross-tenant impact and may deprioritize patching until a stable release is available, though upgrading remains recommended. Refer to the VulnCheck advisory at https://www.vulncheck.com/advisories/vendure-cross-channel-authorization-bypass-via-stocklocation-and-asset-update for additional context.