Auth bypass in Spree
CVE-2026-25758
Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (50.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.001
Affected products
- Spree — versions < 4.10.3, >= 5.0.0, < 5.0.8, >= 5.1.0.beta, < 5.1.10
- Spreecommerce Spree
Weakness classification (CWE)
References
- github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6 (Exploit, Vendor Advisory)
- github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734 (Patch)
- github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f (Patch)
- github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8 (Patch)
- github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748 (Patch)
- github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054 (Patch)
- github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/m… (Patch)
- github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/m… (Patch)
- github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/s… (Patch)
- github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/s… (Patch)
Frequently asked questions
- What is CVE-2026-25758?
- CVE-2026-25758 is a high-severity vulnerability in Spree, classified under Improper Access Control. CVSS score: 7.5/10. Published 2026-02-06.
- How severe is CVE-2026-25758?
- High severity. CVSS v3 base score is 7.5 out of 10.