{"id":"GHSA-xf65-r35x-wmmv","summary":"Vendure: Shop API list queries can return non-public entities when filterOperator is OR","details":"The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combined with the caller-supplied filter using the caller-controlled `filterOperator`. When a caller sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.\n\n### Impact\nExposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.\n\n### Patches\nThe injected guard is now always AND-combined with the caller-supplied filter, regardless of `filterOperator`.\n\n### Workarounds\nNone other than upgrading.","aliases":["CVE-2026-63461"],"modified":"2026-09-17T15:00:05.922876882Z","published":"2026-09-17T14:50:02Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-200"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-17T14:50:02Z"},"references":[{"type":"WEB","url":"https://github.com/vendurehq/vendure/security/advisories/GHSA-xf65-r35x-wmmv"},{"type":"WEB","url":"https://github.com/vendurehq/vendure/commit/6daf5cb8571321eb6c6afa1d8e95a390c060be02"},{"type":"PACKAGE","url":"https://github.com/vendurehq/vendure"},{"type":"WEB","url":"https://github.com/vendurehq/vendure/releases/tag/v3.6.5"}],"affected":[{"package":{"name":"@vendure/core","ecosystem":"npm","purl":"pkg:npm/%40vendure/core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"3.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-xf65-r35x-wmmv/GHSA-xf65-r35x-wmmv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}