{"id":"CVE-2026-63461","aliases":["EUVD-2026-81669","GHSA-xf65-r35x-wmmv"],"status":"published","title":"Vendure: Shop API list queries can return non-public entities when filterOperator is OR","description":"Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0044,"percentile":0.38721,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-09-17T14:43:01Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"npm","package":"@vendure/core","fixed_in":["3.6.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@vendure/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"3.6.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@vendure/core","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"3.6.5"}]}]}],"products":[{"vendor":"vendurehq","product":"vendure"}],"references":[{"url":"https://github.com/vendurehq/vendure/security/advisories/GHSA-xf65-r35x-wmmv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vendurehq/vendure/commit/6daf5cb8571321eb6c6afa1d8e95a390c060be02","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vendurehq/vendure/releases/tag/v3.6.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-xf65-r35x-wmmv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63461.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63461","tags":["advisory"]},{"url":"https://github.com/vendurehq/vendure","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-63461","title":"Vendure: Shop API list queries can return non-public entities when filterOperator is OR","description":"Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.","status":"published","published":"2026-09-17T14:43:01.879Z","modified":"2026-09-17T19:19:43.824Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-81669","description":"Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.","status":"published","published":"2026-09-17T14:43:01Z","modified":"2026-09-17T19:19:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:10.042182Z"}],"ghsa":[{"id":"GHSA-xf65-r35x-wmmv","title":"Vendure: Shop API list queries can return non-public entities when filterOperator is OR","description":"The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combined with the caller-supplied filter using the caller-controlled `filterOperator`. When a caller sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.\n\n### Impact\nExposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.\n\n### Patches\nThe injected guard is now always AND-combined with the caller-supplied filter, regardless of `filterOperator`.\n\n### Workarounds\nNone other than upgrading.","status":"published","published":"2026-09-17T14:50:02Z","modified":"2026-09-17T14:50:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:41:17.136201Z"}],"nvd":[{"id":"CVE-2026-63461","description":"Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.","status":"published","published":"2026-09-17T15:16:49.597Z","modified":"2026-09-17T21:16:02.56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"CVE-2026-63461","title":"Vendure: Shop API list queries can return non-public entities when filterOperator is OR","description":"Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.","status":"published","published":"2026-09-17T14:43:01.879Z","modified":"2026-10-28T02:30:50.432691817Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-xf65-r35x-wmmv","title":"Vendure: Shop API list queries can return non-public entities when filterOperator is OR","description":"The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combined with the caller-supplied filter using the caller-controlled `filterOperator`. When a caller sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.\n\n### Impact\nExposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.\n\n### Patches\nThe injected guard is now always AND-combined with the caller-supplied filter, regardless of `filterOperator`.\n\n### Workarounds\nNone other than upgrading.","status":"published","published":"2026-09-17T14:50:02Z","modified":"2026-09-17T15:00:05.922876882Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}