Vendure
Monthly
Cross-channel authorization bypass in Vendure through 3.7.1 allows a low-privileged, channel-scoped administrator to overwrite StockLocation inventory records and Asset catalog entries belonging to other tenants by submitting global GraphQL entity IDs that their channel does not own. The flaw is in the update methods of stock-location.service.ts and asset.service.ts, which omit the required channelId filter during entity lookup, permitting cross-tenant data corruption without triggering any authorization error. A public proof-of-concept exists via GitHub issue #5003, and an upstream fix is available in commit f67ef5f via PR #5017, though a tagged release version incorporating the fix has not been independently confirmed.
Vendure versions up to 3.5.3 contains a vulnerability that allows attackers to enumerate valid usernames (email addresses) (CVSS 5.3).
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-channel authorization bypass in Vendure through 3.7.1 allows a low-privileged, channel-scoped administrator to overwrite StockLocation inventory records and Asset catalog entries belonging to other tenants by submitting global GraphQL entity IDs that their channel does not own. The flaw is in the update methods of stock-location.service.ts and asset.service.ts, which omit the required channelId filter during entity lookup, permitting cross-tenant data corruption without triggering any authorization error. A public proof-of-concept exists via GitHub issue #5003, and an upstream fix is available in commit f67ef5f via PR #5017, though a tagged release version incorporating the fix has not been independently confirmed.
Vendure versions up to 3.5.3 contains a vulnerability that allows attackers to enumerate valid usernames (email addresses) (CVSS 5.3).
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.