spree vulnerabilities

Products

• spree 7
• spree_auth_devise 1

Latest spree CVEs

Newest publication first

1. CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

   Published 2026-09-22

   High·CVSS 7.1 EPSS 0.38%

   Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require...

2. CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID

   Published 2026-02-06

   High·CVSS 7.7 EPSS 0.49% PoC

   Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phon...

3. CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses

   Published 2026-02-06

   High·CVSS 7.7 EPSS 0.67% PoC

   Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unaut...

4. CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address

   Published 2026-01-10

   High·CVSS 7.5 EPSS 0.45% PoC

   Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address informa...

5. CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

   Published 2026-01-08

   Medium·CVSS 6.5 EPSS 0.41% PoC

   Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address inform...

6. CVE-2021-41275 Authentication Bypass by CSRF Weakness

   Published 2021-11-17

   High·CVSS 8.8 EPSS 0.65% PoC

   spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that...

7. CVE-2020-26223 Authorization bypass in Spree

   Published 2020-11-13

   Medium·CVSS 6.5 EPSS 1.1% PoC

   Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string...

8. CVE-2020-15269 Expired token reuse in Spree

   Published 2020-10-20

   Critical·CVSS 9.1 EPSS 1.1% PoC

   In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.