CVE-2026-67347: Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that al
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-67347
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-673470.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-67347 | coverage & exploitation status | NVD · CVE.org |
More from NVD Recent CVEs
- criticalCVE-2026-8457: The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in a…2026-08-02
- highCVE-2026-18352: The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versi…2026-08-02
- highCVE-2026-13339: The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions…2026-08-02
- unknownCVE-2026-17002: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.2026-08-01
- unknownCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…2026-08-01