7.5

CVE-2026-22589

Exploit

Spree API has Unauthenticated IDOR - Guest Address

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Spreecommerce ≫ Spree Version < 4.10.2
Spreecommerce ≫ Spree Version >= 5.0.0 < 5.0.7
Spreecommerce ≫ Spree Version >= 5.1.0 < 5.1.9
Spreecommerce ≫ Spree Version >= 5.2.0 < 5.2.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.299
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr
Vendor Advisory
Exploit
https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795
Patch
https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad
Patch
https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67
Patch
https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad
Patch