Log in Start free

Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-25758Spree allows unauthenticated users can access all guest addresses

High 7.7

In plain English

A high-severity authorization bypass via user-controlled key in spree from spree. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.7High
Exploit odds (30 days)0.7%top 47.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsspree_api4.10.3GHSA-87fh-rc96-6fr6
RubyGemsspree_api5.0.8GHSA-87fh-rc96-6fr6
RubyGemsspree_api5.1.10GHSA-87fh-rc96-6fr6
RubyGemsspree_api5.2.7GHSA-87fh-rc96-6fr6
RubyGemsspree_api5.3.2GHSA-87fh-rc96-6fr6

Affected products (as reported)

VendorProductVersions
spree spree < 4.10.3>= 5.0.0, < 5.0.8>= 5.1.0.beta, < 5.1.10>= 5.2.0.rc1, < 5.2.7>= 5.3.0.rc2, < 5.3.2

Weakness: CWE-639, CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References