CVE-2026-67347 in Vendure
Summary
by MITRE • 07/30/2026
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability exists within the Vendure e-commerce platform version 3.7.1 and was subsequently addressed in commit f67ef5f. The flaw manifests as a cross-channel authorization bypass affecting two critical service components: stock-location.service.ts and asset.service.ts. The technical implementation fails to enforce proper channel isolation boundaries during update operations, creating a path for unauthorized data modification across tenant segments.
The root cause of this vulnerability lies in the absence of comprehensive channel validation within the update methods of both service files. When administrators perform update operations on StockLocation or Asset entities, the system does not verify whether the requested global IDs belong to the authenticated channel's scope. This omission allows attackers to manipulate entity references using valid global identifiers from different channels, effectively bypassing the intended multi-tenant data isolation mechanisms.
The operational impact of this vulnerability extends beyond simple data integrity concerns, as it enables unauthorized administrative access across tenant boundaries. Attackers can exploit this weakness to modify inventory locations and catalog assets belonging to other tenants, potentially causing significant disruption to business operations and data consistency. The vulnerability particularly affects channel-scoped administrators who should only have access to their designated tenant's resources.
This security flaw aligns with CWE-639, which describes authorization flaws that permit unauthorized access to resources. The issue also maps to ATT&CK technique T1078.004, representing valid accounts used for unauthorized access. The vulnerability demonstrates a critical failure in the principle of least privilege enforcement within multi-tenant applications.
Mitigation strategies should focus on implementing robust channel validation checks before processing update requests. The fix requires adding explicit verification logic that ensures global IDs reference entities within the authenticated channel's scope. Additionally, comprehensive logging of cross-channel access attempts should be implemented to detect potential exploitation attempts. Organizations should also review their existing multi-tenant configurations and ensure proper segregation controls are in place across all service components handling tenant-specific data operations.
The vulnerability highlights the importance of thorough security testing for multi-tenant applications, particularly focusing on authorization boundaries and data isolation mechanisms. Regular security assessments and code reviews should specifically target service methods that handle entity updates to prevent similar cross-channel access issues from emerging in future releases.