CVE-2026-63461: Vendure: Shop API list queries can return non-public entities when filterOperator is OR
The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false). This injected guard was combined with the caller-supplied filter using the caller-controlled filterOperator. When a caller sets filterOperator: OR, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.
Impact Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.
Patches The injected guard is now always AND-combined with the caller-supplied filter, regardless of filterOperator.
Workarounds None other than upgrading.
Other sources
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@vendure/coreto a version that resolves this vulnerability.Fixed in 3.6.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user able to send queries to the publicly accessible Shop API can attempt exploitation. The affected query types are products, collections, and facets.
What is required to retrieve hidden entities?
The caller must set filterOperator to OR and provide a predicate that matches the disabled product or private collection or facet they want returned. This causes the visibility guard to be OR-combined rather than enforced alongside the supplied filter.
Are default public Shop API deployments affected?
Yes. The Shop API is publicly accessible and exploitation does not require authentication; the issue affects versions of @vendure/core prior to 3.6.5.
What should be done if immediate patching is not possible?
No workaround is provided other than upgrading. Upgrade to version 3.6.5 or later, where mandatory visibility guards are always AND-combined with caller-supplied filters.