Skip to content
OpenAdvisories

Vendor

spree

8 known vulnerabilities.

Products

spree 7 spree_auth_devise 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-22588

    Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

    Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other …

    spree spree spree_api RubyGems