CVE-2026-67347: Incorrect Authorization in vendurehq vendure
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.
AI Analysis
Technical Summary
CVE-2026-67347 is a medium severity vulnerability in Vendure through version 3.7.1. It involves a cross-channel authorization bypass in the update methods of stock-location.service.ts and asset.service.ts. Channel-scoped administrators can supply global IDs of StockLocation or Asset entities from other channels, bypassing channel isolation checks and modifying data of other tenants. This flaw allows unauthorized modification of inventory locations and catalog assets across tenant boundaries. The vulnerability was fixed in commit f67ef5f.
Potential Impact
Attackers with channel-scoped administrator privileges can modify inventory and asset data belonging to other tenants, violating data isolation and potentially causing data integrity issues across channels. This could lead to unauthorized data changes affecting multiple tenants in a multi-tenant environment.
Mitigation Recommendations
A fix for this vulnerability is available in Vendure after commit f67ef5f. Users should upgrade to a version including this fix to prevent cross-channel authorization bypass. Patch status is not explicitly confirmed in the advisory, but the fix commit indicates an official resolution. No alternative mitigations are provided.
CVE-2026-67347: Incorrect Authorization in vendurehq vendure
Description
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.
CVSS v4.0
Score 6.1medium
Affected software
vendurehq
vendure
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67347 is a medium severity vulnerability in Vendure through version 3.7.1. It involves a cross-channel authorization bypass in the update methods of stock-location.service.ts and asset.service.ts. Channel-scoped administrators can supply global IDs of StockLocation or Asset entities from other channels, bypassing channel isolation checks and modifying data of other tenants. This flaw allows unauthorized modification of inventory locations and catalog assets across tenant boundaries. The vulnerability was fixed in commit f67ef5f.
Potential Impact
Attackers with channel-scoped administrator privileges can modify inventory and asset data belonging to other tenants, violating data isolation and potentially causing data integrity issues across channels. This could lead to unauthorized data changes affecting multiple tenants in a multi-tenant environment.
Mitigation Recommendations
A fix for this vulnerability is available in Vendure after commit f67ef5f. Users should upgrade to a version including this fix to prevent cross-channel authorization bypass. Patch status is not explicitly confirmed in the advisory, but the fix commit indicates an official resolution. No alternative mitigations are provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-29T13:09:45.993Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6b816b9c2644c7f860ebd2
Added to database: 07/30/2026, 16:52:59 UTC
Last enriched: 08/15/2026, 13:49:41 UTC
Last updated: 09/11/2026, 22:06:34 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.