{"action":"Upgrade @vendure/core to 3.6.5 or later.","affected":[{"fixed":"3.6.5","introduced":"1.0.0"}],"component":"@vendure/core","cve_ids":["CVE-2026-63461"],"ecosystem":"npm","epss":0.0044,"exploited":false,"fixed_versions":["3.6.5"],"ghsa_id":"GHSA-xf65-r35x-wmmv","id":"tcs_01M5KGHRGD98HPAJMST0VCWXRB","modified_at":"2026-09-17T15:00:05.922876882Z","published_at":"2026-09-17T14:50:02Z","references":["https://osv.dev/vulnerability/GHSA-xf65-r35x-wmmv","https://github.com/vendurehq/vendure/security/advisories/GHSA-xf65-r35x-wmmv","https://github.com/vendurehq/vendure/commit/6daf5cb8571321eb6c6afa1d8e95a390c060be02","https://github.com/vendurehq/vendure","https://github.com/vendurehq/vendure/releases/tag/v3.6.5"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-xf65-r35x-wmmv","url":"https://osv.dev/vulnerability/GHSA-xf65-r35x-wmmv"}],"summary":"Vendure: Shop API list queries can return non-public entities when filterOperator is OR"}