AIKIDO-2026-765852
@vendure/core is vulnerable to Insecure Direct Object Reference (IDOR)
65
Medium Risk
This Affects:
@vendure/coreTL;DR
Two Admin API delete paths, PromotionService.softDeletePromotion and FacetValueService.delete, fetch a channel-aware entity by its raw id and delete it without verifying it belongs to the caller's active channel, unlike the sibling update methods in the same services. A channel-restricted administrator holding the relevant delete permission in their own channel can destroy promotions and facet values owned by other channels by enumerating sequential ids. This breaks tenant isolation in multi-channel deployments, disabling other tenants' discount campaigns and corrupting shared catalog facet data. The fix scopes both lookups to the active channel so entities belonging only to another channel are not found.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run a multi-channel deployment where channel-restricted administrators hold promotion or facet delete permissions.
Background info
@vendure/core is vulnerable to Insecure Direct Object Reference (IDOR) in versions 0.0.1 - 3.7.1.
How to fix this
Upgrade the @vendure/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant