CVE-2026-63461— Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Quick assessment
Affected
vendurehq vendure
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vendure 是一个开源的无头（headless）电商平台。在 3.6.5 版本之前，其公共 Shop API 中的产品（products）、集合（collections）和分面（facets）查询会将强制可见性检查与由调用方提供的过滤条件相结合，并使用由调用方控制的 （过滤运算符）。当 设置为 时，一个匹配隐藏实体的谓词条件可以绕过 、 或 的可见性保护。因此，未认证的调用者可以获取到已禁用的产品以及私有的集合或分面。该问题已在 3.6.5 版本中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63461
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Source: CVE Program / CVE List V5
Vulnerability Description
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-63461
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63461
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-63461 (1)
Vendor Advisories for CVE-2026-63461 (1)
Vendor Pages for CVE-2026-63461 (1)
-
🔗 Release v3.6.5 · vendurehq/vendure · GitHub x_refsource_MISC
Same Patch Batch · vendurehq · 2026-09-17 · 4 CVEs total
| CVE-2026-63472 | 9.1 CRITICAL | Vendure: External-authentication account takeover: external login linked to a pre-existing |
| CVE-2026-63459 | 8.7 HIGH | Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity |
| CVE-2026-63460 | 7.5 HIGH | Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends |
IV. Related Vulnerabilities
Same product: vendure
-
CVE-2026-63459
Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-s -
CVE-2026-63472
Vendure: External-authentication account takeover: external -
CVE-2026-63460
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite -
CVE-2026-67347
Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLo -
CVE-2026-40887
@vendure/core has a SQL Injection vulnerability
Same vendor: vendurehq
-
CVE-2026-63459
Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-s -
CVE-2026-63472
Vendure: External-authentication account takeover: external -
CVE-2026-63460
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite -
CVE-2026-67347
Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLo -
CVE-2026-40887
@vendure/core has a SQL Injection vulnerability
Same weakness: CWE-200
-
CVE-2026-85717
AsyncHttpClient: Client-wide realm credentials re-sent to a -
CVE-2026-69197
Umbraco: Delivery API leaks protected (Public Access) conten -
CVE-2026-75523
Steeltoe.Management.Endpoint: HttpExchanges URI masking leak -
CVE-2026-80356
Dell OpenManage 11.1.0.3前版本敏感信息泄露漏洞 -
CVE-2026-92960
vm2 before 3.11.6 Process-wide State Exposure via os and dns
V. Comments for CVE-2026-63461
No comments yet