CyberRota Analysis
AI-GeneratedF5's Vendure versions up to 3.7.1 are vulnerable to a cross-channel authorization bypass, allowing channel-scoped administrators to manipulate data belonging to other tenants by exploiting the update methods in stock-location.service.ts and asset.service.ts. This vulnerability enables unauthorized modifications of inventory locations and catalog assets, posing a risk to data integrity across tenant environments. Organizations utilizing Vendure should prioritize patching to mitigate potential data breaches and maintain proper channel isolation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.