CVE-2020-26223 Authorization bypass in Spree

What is CVE-2020-26223?

CVE-2020-26223 is a high-severity authentication bypass vulnerability in spree, published on 13 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

Weakness: CWE-863

Which versions are affected by CVE-2020-26223?

6 open source packages ship an affected version, including spree_api. It affects 1 product.

Products include Spreecommerce Spree.

How do I fix CVE-2020-26223?

Upgrade spree_api to a fixed version for your release line: 3.7.13, 4.0.5 or 4.1.12.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-26223 being exploited?

There is no known exploitation of CVE-2020-26223 in the wild and no public exploit code.

Other vulnerabilities in spree

• CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE Critical 10.0
• CVE-2011-10026 Spreecommerce < 0.50.x API RCE Critical 9.3
• CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID High 7.7
• CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses High 7.7
• CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m2jr-hmc3-qmpr.