spreecommerce vulnerabilities

Products

• spree 12
• spree auth devise 1
• Spreecommerce 1

Latest spreecommerce CVEs

Newest publication first

1. CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID

   Published 2026-02-06

   High·CVSS 7.7 EPSS 0.49% PoC

   Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phon...

2. CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses

   Published 2026-02-06

   High·CVSS 7.7 EPSS 0.67% PoC

   Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unaut...

3. CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address

   Published 2026-01-10

   High·CVSS 7.5 EPSS 0.45% PoC

   Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address informa...

4. CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

   Published 2026-01-08

   Medium·CVSS 6.5 EPSS 0.41% PoC

   Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address inform...

5. CVE-2011-10026 Spreecommerce < 0.50.x API RCE

   Published 2025-08-20

   Critical·CVSS 9.3 EPSS 4.0% Framework module Public exploit PoC

   Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Rub...

6. CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE

   Published 2025-08-13

   Critical·CVSS 10.0 EPSS 6.3% Framework module Public exploit PoC

   Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attac...

7. CVE-2021-41275 Authentication Bypass by CSRF Weakness

   Published 2021-11-17

   High·CVSS 8.8 EPSS 0.65% PoC

   spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that...

8. CVE-2020-26223 Authorization bypass in Spree

   Published 2020-11-13

   Medium·CVSS 6.5 EPSS 1.1% PoC

   Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string...

9. CVE-2013-1656 Spree Improper Input Validation vulnerability

   Published 2013-03-08

   Medium·CVSS 4.3 EPSS 1.5% PoC

   Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action...

10. CVE-2013-2506 spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles

    Published 2013-03-08

    Medium·CVSS 4.0 EPSS 1.3% PoC

    app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

11. CVE-2008-7310 Spree does not properly restrict the use of a hash to provide values for a model's attributes

    Published 2012-04-04

    Medium·CVSS 5.0 EPSS 1.2% PoC

    Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.

12. CVE-2008-7311 Spree uses a hardcoded hash value

    Published 2012-04-04

    Medium·CVSS 5.0 EPSS 1.2% PoC

    The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value wit...

13. CVE-2010-3978 Spree allows remote attackers to obtain sensitive information

    Published 2010-11-17

    Medium·CVSS 5.0 EPSS 2.5% PoC

    Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.jso...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.