{"id":"CVE-2026-63461","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-63461","summary":"Vendure: Shop API list queries can return non-public entities when filterOperator is OR","details":"The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combined with the caller-supplied filter using the caller-controlled `filterOperator`. When a caller sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.\n\n### Impact\nExposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.\n\n### Patches\nThe injected guard is now always AND-combined with the caller-supplied filter, regardless of `filterOperator`.\n\n### Workarounds\nNone other than upgrading.","published":"2026-09-17T14:50:02Z","modified":"2026-09-17T15:00:05.922876882Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@vendure/core","fixedVersion":"3.6.5"}],"fix":{"url":"https://github.com/vendurehq/vendure/commit/6daf5cb8571321eb6c6afa1d8e95a390c060be02","label":"vendurehq/vendure@6daf5cb"},"references":[{"type":"WEB","url":"https://github.com/vendurehq/vendure/security/advisories/GHSA-xf65-r35x-wmmv"},{"type":"WEB","url":"https://github.com/vendurehq/vendure/commit/6daf5cb8571321eb6c6afa1d8e95a390c060be02"},{"type":"PACKAGE","url":"https://github.com/vendurehq/vendure"},{"type":"WEB","url":"https://github.com/vendurehq/vendure/releases/tag/v3.6.5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-17T15:00:05.922876882Z"}}