Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.where(user: [nil, currentuser]).findbyprefixid!(params[:id]) — and omits the authorize!(:update, @cart, carttoken) check that every other action in the controller performs via CartResolvable. Because prefixed IDs are a reversible Sqids encoding of the auto-increment primary key (obfuscation, not a token), an authenticated customer can name arbitrary guest cart IDs, take them over, and read the checkout addresses stored on them. This is broken access control / IDOR, reachable by any low-privilege registered user. Severity Requires an authenticated store account and depends on target guest carts already carrying an address and not yet being associated, on a store not running in loginrequired mode. Confidentiality impact is the driver (guest checkout PII); integrity…
Recommended action: Upgrade to 5.5.4 or 5.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. Impact This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). Unauthenticated users can access all guest addresses (GHSL-2026-027) The vulnerability stems from incomplete authorization validation in Spree's checkout address assignment logic. While nested address attributes (billaddressattributes[id] and shipaddressattributes[id]) are properly validated through validateaddressownership, plain ID parameters (billaddressid and shipaddressid) bypass this check entirely. Since Spree's address IDs are…
Recommended action: Upgrade to 5.3.2, 5.2.7, 5.1.10 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker’s order and returning them in the response. Details Affected Component(s) - Authenticated user order management - Address association logic - Order update endpoint(s) Affected Endpoint(s): - /api/v2/storefront/checkout The application fails to enforce proper object-level authorization when updating an existing order. While the user is authenticated and authorized to modify their own order, the backend does not verify that the supplied address identifiers belong to the same authenticated user. PoC Preconditions - Valid authenticated user…
Recommended action: Upgrade to 5.2.5, 5.1.9, 5.0.7 or 4.10.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected. References Pull request with a fix and in-depth explanation - https://github.com/spree/spree/pull/10573 For more information If you have any questions or comments about this advisory: Email us at security@spreecommerce.org
Recommended action: Upgrade to 4.1.12, 4.0.5 or 3.7.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.