H3-2026-1054¶

Vendure adjustDraftOrderLine Authorization Bypass Vulnerability

Description¶

Vendure, an open-source e-commerce framework, contains a missing authorization vulnerability in the adjustDraftOrderLine Admin API mutation. The mutation decorator includes Permission.Owner alongside Permission.UpdateOrder, which causes the AuthGuard to create an anonymous session for unauthenticated requests rather than rejecting them. Because draft orders have no owning customer, the Owner permission provides no meaningful access scoping, and effectively bypasses the admin authentication requirement. Remote attackers can exploit this by sending a GraphQL mutation to the /admin-api endpoint with a target order ID. The vulnerability affects Vendure instances that expose the Admin API to network-reachable attackers.

Impact¶

Remote attackers can modify line quantities of any draft order and can read order data without credentials. This bypasses the admin authentication boundary entirely for the affected mutation. E-commerce platforms using Vendure for order management are directly affected. Exposure of order data might impinge on data-protection regulations for affected merchants.

References¶

• Vendure GitHub Security Advisory GHSA-hc75-2v4j-x372
• Vendure Patch Commit for adjustDraftOrderLine Permission Fix