AIKIDO-2026-422762
@vendure/core is vulnerable to Improper Authorization
96
Critical Risk
This Affects:
@vendure/coreTL;DR
The Admin API channel update and delete operations resolve the target Channel by raw id without scoping the lookup to the caller's active channel. Any administrator holding the UpdateChannel or DeleteChannel permission can therefore rename or permanently delete any Channel in the system, including channels their role has no relationship to. The fix scopes the Channel lookups so operations are restricted to channels the caller can access.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run a multi-channel store with administrators whose roles are scoped to specific channels.
Background info
@vendure/core is vulnerable to Improper Authorization in versions 0.16.0 - 3.7.2.
How to fix this
Upgrade the @vendure/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.