AIKIDO-2026-755646
@vendure/core is vulnerable to Insecure Direct Object Reference (IDOR)
50
Medium Risk
This Affects:
@vendure/coreTL;DR
The Admin API update mutations for assets and stock locations resolve the target entity by ID without restricting the lookup to the caller's active channel. A channel-restricted administrator can supply IDs belonging to other channels and modify asset metadata such as name, tags, focalPoint, and custom fields, or stock location configuration, across tenant boundaries. Sibling operations already enforced channel scoping, so only these two write paths were exposed. The fix adds channel-scope guards to AssetService.update and StockLocationService.update so entities outside the active channel are rejected.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run a multi-channel deployment with channel-restricted administrators.
Background info
@vendure/core is vulnerable to Insecure Direct Object Reference (IDOR) in versions 0.0.1 - 3.7.1.
How to fix this
Upgrade the @vendure/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.