CVE-2026-67347: Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vendureto a version that resolves this vulnerability.Patch f67ef5f
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67347?
CVE-2026-67347 has a severity rating of medium, with a score of 6.1.
How do I fix CVE-2026-67347?
To fix CVE-2026-67347, upgrade to Vendure version 3.7.2 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2026-67347?
CVE-2026-67347 is classified as a cross-channel authorization bypass vulnerability.
Who is affected by CVE-2026-67347?
CVE-2026-67347 affects Vendure users utilizing versions up to 3.7.1 with channel-scoped administrators.
What can attackers do with CVE-2026-67347?
Attackers can exploit CVE-2026-67347 to modify other tenants' data by supplying global IDs for StockLocation or Asset.