GHSA-xf65-r35x-wmmv
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @vendure/core | >= 1.0.0, < 3.6.5 | 3.6.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combined with the caller-supplied filter using the caller-controlled `filterOperator`. When a caller sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.
### Impact
Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.
### Patches
The injected guard is now always AND-combined with the caller-supplied filter, regardless of `filterOperator`.
### Workarounds
None other than upgrading.
References
External links from the advisory. They lead to third-party sites.