CVE-2026-63461Medium· 5.3▾ SunlitVendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperat…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets. This issue is fixed in version 3.6.5.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@vendure/core >= 1.0.0, < 3.6.5Patched in:
@vendure/core 3.6.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63459High· 8.7Vendure is an open-source headless commerce platform
CVE-2026-63460High· 7.5Vendure is an open-source headless commerce platform
CVE-2026-63472Critical· 9.1Vendure is an open-source headless commerce platform
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2023-29348High· 7.5Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability
CVE-2025-13647Medium· 5.8Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths