Vendure: Shop API list queries can return non-public entities when filterOperator is OR
The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false). This injected guard was combined with the caller-supplied filter using the caller-controlled filterOperator. When a caller sets filterOperator: OR, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.
Impact
Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.
Patches
The injected guard is now always AND-combined with the caller-supplied filter, regardless of filterOperator.
Workarounds
None other than upgrading.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @vendure/core | >= 1.0.0, < 3.6.5 | 3.6.5 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-200- Platform
- npm
- Package
@vendure/core- Disclosed
- 17.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-xf65-r35x-wmmv - CC BY 4.0
Vulnerability history: @vendure/core
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 07.2023 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
- Medium 2
- Low 2
Disclosures per year
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 5
-
Vendure: Shop API list queries can return non-public entities when filterOperator is OR this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.