Spree
7 CVEs across 2 Spree products. Browse Spree vulnerabilities, severities, and proof-of-concept exploits.
Spree products with known CVEs
Spree CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-25757 | Medium | 5.3 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view complet… |
CVE-2026-25758 | High | 7.5 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows… |
CVE-2026-22589 | High | 7.5 | 2026-01-10 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Obj… |
CVE-2026-22588 | Medium | 6.5 | 2026-01-08 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Objec… |
CVE-2021-41275 | Critical | 9.3 | 2021-11-17 | spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an un… |
CVE-2020-26223 | High | 7.7 | 2020-11-13 | Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is… |
CVE-2020-15269 | High | 7.4 | 2020-10-20 | In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3… |