GHSA-xf65-r35x-wmmv
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Quick fix
GHSA-xf65-r35x-wmmv — @vendure/core: upgrade to the fixed version with the command below.
npm install @vendure/core@3.6.5Details
The Shop API `products`, `collections` and `facets` queries inject a mandatory filter to restrict results to publicly-visible entities (`Product.enabled = true`, `Collection.isPrivate = false`, `Facet.isPrivate = false`). This injected guard was combined with the caller-supplied filter using the caller-controlled `filterOperator`. When a caller sets `filterOperator: OR`, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.
### Impact Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.
### Patches The injected guard is now always AND-combined with the caller-supplied filter, regardless of `filterOperator`.
### Workarounds None other than upgrading.
Are you affected?
Enter the version of the package you're using.