CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address
Unauthenticated attackers can access guest address information in Spree e-commerce due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22589?
CVE-2026-22589 is a high-severity missing authorization vulnerability in spree, published on 10 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
Weakness: CWE-639
Which versions are affected by CVE-2026-22589?
8 open source packages ship an affected version, including spree_core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
spree_core RubyGems | From 4.0.0 | 4.10.2 |
spree_core RubyGems | From 4.0.0 | 4.10.2 |
spree_core RubyGems | From 5.0.0 | 5.0.7 |
spree_core RubyGems | From 5.0.0 | 5.0.7 |
spree_core RubyGems | From 5.1.0 | 5.1.9 |
spree_core RubyGems | From 5.1.0 | 5.1.9 |
2 more packages
spree_core RubyGems | From 5.2.0 | 5.2.5 |
spree_core RubyGems | From 5.2.0 | 5.2.5 |
Products include Spreecommerce Spree.
How do I fix CVE-2026-22589?
Upgrade spree_core to a fixed version for your release line: 4.10.2, 5.0.7, 5.1.9 or 5.2.5.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-22589 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22589 exists.
Other vulnerabilities in spree
- CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE
- CVE-2011-10026 Spreecommerce < 0.50.x API RCE
- CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID
- CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses
- CVE-2020-26223 Authorization bypass in Spree
Sources
Also known as GHSA-3ghg-3787-w2xr.