Skip to content
OpenAdvisories

Package · RubyGems

spree_api

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.1
    CVE-2026-94462

    Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

    Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id …

    spree spree spree_api RubyGems
  • High 7.7
    CVE-2026-25758

    Spree allows unauthenticated users can access all guest addresses

    Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameter…

    spree spree spree_api RubyGems
  • Medium 6.5
    CVE-2026-22588

    Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

    Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other …

    spree spree spree_api RubyGems
  • High 7.7
    CVE-2020-26223

    Authorization bypass in Spree

    Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint…

    spree spree spree_api RubyGems