CVE-2026-63461

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.

The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false). This injected guard was combined with the caller-supplied filter using the caller-controlled filterOperator. When a caller sets filterOperator: OR, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.

Impact

Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.

Patches

The injected guard is now always AND-combined with the caller-supplied filter, regardless of filterOperator.

Workarounds

None other than upgrading.

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.

The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false). This injected guard was combined with the caller-supplied filter using the caller-controlled filterOperator. When a caller sets filterOperator: OR, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.

Impact

Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.

Patches

The injected guard is now always AND-combined with the caller-supplied filter, regardless of filterOperator.

Workarounds

None other than upgrading.