CVE-2026-25758
CVE-2026-25758 is a high-severity vulnerability in Spreecommerce Spree with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-639.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v4: 7.7
- EPSS exploit prediction: 1% (55th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-5563
- Weakness: CWE-639
- Affected product: Spreecommerce Spree
- Published:
- Last modified:
Description
Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
Frequently asked questions
- What is CVE-2026-25758?
- Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
- How severe is CVE-2026-25758?
- CVE-2026-25758 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2026-25758 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-25758?
- CVE-2026-25758 affects Spreecommerce Spree. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-25758?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-25758 have an EU (EUVD) identifier?
- Yes. CVE-2026-25758 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5563.
- When was CVE-2026-25758 published?
- CVE-2026-25758 was published on 2026-02-06 and last updated on 2026-06-17.
References
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96
- https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734
- https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f
- https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8
- https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748
- https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054
- https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
Affected products (1)
- cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*
More vulnerabilities in Spreecommerce Spree
- CVE-2011-10026 — Critical (CVSS 9.8): Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search…
- CVE-2011-10019 — Critical (CVSS 9.8): Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality.…
- CVE-2020-26223 — High (CVSS 7.7): Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before…
- CVE-2026-22589 — High (CVSS 7.5): Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and…
- CVE-2026-22588 — Medium (CVSS 6.5): Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and…
- CVE-2026-25757 — Medium (CVSS 5.3): Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and…
All CVEs affecting Spreecommerce Spree →
Other CWE-639 (Authorization Bypass Through User-Controlled Key (IDOR)) vulnerabilities
- CVE-2024-34323 — Critical (CVSS 10.0): ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the…
- CVE-2026-69865 — Critical (CVSS 10.0): Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to…
- CVE-2026-83711 — Critical (CVSS 10.0): Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized…
- CVE-2026-77998 — Critical (CVSS 10.0): Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML…
- CVE-2026-77995 — Critical (CVSS 10.0): Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On…
- CVE-2025-40805 — Critical (CVSS 10.0): Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an…
Browse all CWE-639 (Authorization Bypass Through User-Controlled Key (IDOR)) vulnerabilities →