AIKIDO-2026-765852
@vendure/core is vulnerable to Insecure Direct Object Reference (IDOR)
65
CVE Score
Medium
Insecure Direct Object Reference (IDOR)
TL;DR
Two Admin API delete paths, PromotionService.softDeletePromotion and FacetValueService.delete, fetch a channel-aware entity by its raw id and delete it without verifying it belongs to the caller's active channel, unlike the sibling update methods in the same services. A channel-restricted administrator holding the relevant delete permission in their own channel can destroy promotions and facet values owned by other channels by enumerating sequential ids. This breaks tenant isolation in multi-channel deployments, disabling other tenants' discount campaigns and corrupting shared catalog facet data. The fix scopes both lookups to the active channel so entities belonging only to another channel are not found.
How do I fix this?
Upgrade the @vendure/core library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run a multi-channel deployment where channel-restricted administrators hold promotion or facet delete permissions.
Package
Versions
0.0.1 - 3.7.1
Fixed in 3.7.2Background info
@vendure/core is vulnerable to Insecure Direct Object Reference (IDOR) in versions 0.0.1 - 3.7.1.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.