CVE-2026-67347

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.7.2

Description An authorization bypass exists in the update methods of stock-location.service.ts and asset.service.ts. This issue allows channel-scoped administrators to modify data belonging to other tenants by providing global IDs of StockLocation or Asset entities from different channels. The flaw occurs because the system fails to perform proper channel isolation validation, enabling the overwriting of inventory locations or catalog assets across different tenants.

Recommendations Update to version 3.7.2 or later.