Log in Start free

Vulnerability · Published Jan 8, 2026 · Assigned by GitHub_M

CVE-2026-22588Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in spree from spree. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 64.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker’s order and returning them in the response. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsspree_api4.10.2GHSA-g268-72p7-9j6j
RubyGemsspree_api5.0.7GHSA-g268-72p7-9j6j
RubyGemsspree_api5.1.9GHSA-g268-72p7-9j6j
RubyGemsspree_api5.2.5GHSA-g268-72p7-9j6j

Affected products (as reported)

VendorProductVersions
spree spree >= 5.2.0, < 5.2.5>= 5.1.0, < 5.1.9>= 5.0.0, < 5.0.7< 4.10.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References