CVE-2026-67347

Deferred Deferred - Pending Action

Cross-Channel Authorization Bypass in Vendure

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-67347

EUVD

EUVD-2026-51150

Affected Vendors & Products

Vendor	Product	Version / Range
vendure	vendure	to 3.7.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-channel authorization bypass in Vendure through 3.7.1. It allows channel-scoped administrators to modify data belonging to other tenants by exploiting insufficient channel isolation validation in stock-location.service.ts and asset.service.ts update methods. Attackers can overwrite inventory locations or catalog assets of other tenants using global IDs.

Detection Guidance

This vulnerability involves improper channel isolation in Vendure versions before commit f67ef5f. To detect it, check if your Vendure instance is running a version prior to the patched commit. Review logs for unauthorized modifications to StockLocation or Asset entities across channels by channel-scoped administrators.

Impact Analysis

If you are a channel-scoped administrator or use Vendure for multi-tenant operations, an attacker could manipulate your inventory or assets, leading to data corruption, unauthorized changes, or service disruption. This could affect business operations and trust in the platform.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, loss of customer trust, and reputational damage.

Mitigation Strategies

Immediately update Vendure to a version that includes commit f67ef5f or later. Ensure proper channel isolation validation is enforced in stock-location.service.ts and asset.service.ts. Restrict administrative privileges to prevent unauthorized cross-channel modifications.

Hi! I’m here to help you understand CVE-2026-67347. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70