You can find the Solidus security policy at https://solidus.io/security.
Repository navigation
Security: solidusio/solidus
Security
SECURITY.md
-
Product API and admin product search mark role-dependent responses as publicly cacheableGHSA-9h39-92j5-v6wm published
Nov 5, 2026 by jarednormanLow -
Customer can change shipping address after selecting quote via APIGHSA-7p8v-x53p-mgqc published
Nov 5, 2026 by jarednormanModerate -
Order token still reads and changes a cart after the order belongs to a customer accountGHSA-pr4p-xm72-h6r3 published
Nov 5, 2026 by jarednormanModerate -
Admin users can update stock items at restricted stock locationsGHSA-hmf2-mw8g-c8qg published
Nov 5, 2026 by jarednormanLow -
Users can attach guest's gateway payment profile to their own paymentGHSA-qj8v-qw92-p6cx published
Nov 5, 2026 by jarednormanLow -
Stored XSS in solidus_admin (unescaped flash alert)GHSA-97hp-c986-727r published
Nov 5, 2026 by jarednormanHigh -
Customer API keeps the original line price after variant_id is changed to a more expensive SKUGHSA-r9gh-7v7c-6g4j published
Nov 5, 2026 by jarednormanModerate -
Admin-only attributes served to non-admin API clients from shared fragment cacheGHSA-6qcp-q5gw-p7hv published
Nov 5, 2026 by jarednormanModerate -
Missing authorization check on the target shipment in the transfer_to_shipment API endpointGHSA-m8v9-2qv9-xrpj published
Nov 5, 2026 by jarednormanModerate -
Over permissive attributes in Solidus adminGHSA-q5w8-wf94-jc29 published
Nov 5, 2026 by jarednormanLow
Learn more about advisories related to solidusio/solidus in the GitHub Advisory Database