How to use this reference
Editorial lesson: derive child-object authority from the parent order and current channel before any external effect. A later database rejection cannot reliably undo an earlier gateway action. Review alternate entry points against the same invariant, rather than assuming protected parent reads cover mutations.
Before reading
- Basic authorization, application state machines and database transaction concepts
Context and limits
- The reported setting is multi-channel commerce with channel-scoped order-update permission and suitable payment configuration. The advisory reports controlled refund evidence and potential financial disruption; production losses are not established.
- The advisory lists versions below 3.7.3 as affected and 3.7.3 as patched. Release notes confirm channel enforcement and advise upgrading related packages together.
- michaelbromley published the advisory; squinard1478 and raysabee are credited reporters. No CVE is assigned on the reviewed page.
- The release rendering displays September 2 without a year; no complete patch-release date is asserted. Resource edition and its release date remain null.
Sources and provenance
- Cross-channel payment/refund IDOR — money movement across tenants (payment-side sibling of GHSA-frwg) Vendure · reviewed 2026-10-03
- Vendure v3.7.3 release Vendure · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot d5550c789111. Open the complete JSON contract.