THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-xf65-r35x-wmmv (medium) — Vendure: Shop API list queries can return non-public entities when filterOperator is OR

[GHSA] GHSA-xf65-r35x-wmmv (medium) — Vendure: Shop API list queries can return non-public entities when filterOperator is OR

medgithub_advisoriesPublished 2026-09-17

GHSA-xf65-r35x-wmmv Severity: medium CVE: CVE-2026-63461

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combine

Indicators of compromise

CVE-2026-63461cve

Original source: https://github.com/advisories/GHSA-xf65-r35x-wmmv