CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses
Unauthenticated attackers can access other guests' PII by manipulating address IDs in Spree Commerce guest checkout flows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25758?
CVE-2026-25758 is a high-severity missing authorization vulnerability in spree, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
Which versions are affected by CVE-2026-25758?
10 open source packages ship an affected version, including spree_api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
spree_api RubyGems | All versions | 4.10.3 |
spree_api RubyGems | All versions | 4.10.3 |
spree_api RubyGems | From 5.0.0 | 5.0.8 |
spree_api RubyGems | From 5.0.0 | 5.0.8 |
spree_api RubyGems | From 5.1.0 | 5.1.10 |
spree_api RubyGems | From 5.1.0 | 5.1.10 |
4 more packages
spree_api RubyGems | From 5.2.0 | 5.2.7 |
spree_api RubyGems | From 5.2.0 | 5.2.7 |
spree_api RubyGems | From 5.3.0 | 5.3.2 |
spree_api RubyGems | From 5.3.0 | 5.3.2 |
Products include Spreecommerce Spree.
How do I fix CVE-2026-25758?
Upgrade spree_api to a fixed version for your release line: 4.10.3, 5.0.8, 5.1.10 or 5.2.7.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25758 being exploited?
There is no known exploitation of CVE-2026-25758 in the wild and no public exploit code.
Other vulnerabilities in spree
- CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE
- CVE-2011-10026 Spreecommerce < 0.50.x API RCE
- CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID
- CVE-2020-26223 Authorization bypass in Spree
- CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address
Sources
Also known as GHSA-87fh-rc96-6fr6.