High, CVSS 7.7RubyGemsPublished
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
CVE-2026-25757 · GHSA-p6pv-q7rc-g4h9
- Affected
- RubyGems spree_storefront < 5.0.8; >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.7; >= 5.3.0, < 5.3.2
- Fixed in
- 5.3.25.2.75.1.105.0.8· Vendor fix available
- Issue
- Unauthenticated users can view completed guest orders by Order ID (GHSL-2026-029) The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token. Order lookup without enforcing token requirement in OrdersController#show: Authorization bypass for guest orders in authorizeaccess: If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.) Proof of Concept 1. As a guest create a complete order. 2. Fetch the latest Order ID from the database (Table: spreeorders). 3.…
Recommended action: Upgrade to 5.3.2, 5.2.7, 5.1.10 or 5.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.