CVE-2026-63461: falha de média gravidade em vendurehq vendure
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
vendurehq · vendureCVEs relacionadas — vendurehq vendure
No mesmo produto, das mais perigosas para as menos.
CVE-2026-40887CRITICAL@vendure/core has a SQL Injection vulnerabilityEPSS 1.8%CVE-2026-63460HIGHVendure: Unauthenticated ReDoS via `regex` filter on SQLite backendsEPSS 0.6%CVE-2026-63472CRITICALVendure: External-authentication account takeover: external login linked to a pre-existing account by email without verificationEPSS 0.6%CVE-2026-67347MEDIUMVendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset UpdateEPSS 0.5%CVE-2026-63459HIGHVendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptionsEPSS 0.4%CVE-2026-25050LOWVendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategyEPSS 0.4%