CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
Authenticated users can hijack guest carts and steal address data due to missing authorization checks in the cart association API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94462?
CVE-2026-94462 is a high-severity missing authorization vulnerability in spree, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.
Weakness: CWE-639
Which versions are affected by CVE-2026-94462?
4 open source packages ship an affected version, including spree_api.
| Package | Affected | Fixed in |
|---|---|---|
spree_api RubyGems | From 5.4.0 | 5.4.4 |
spree_api RubyGems | From 5.4.0 | 5.4.4 |
spree_api RubyGems | From 5.5.0 | 5.5.4 |
spree_api RubyGems | From 5.5.0 | 5.5.4 |
How do I fix CVE-2026-94462?
Upgrade spree_api to a fixed version for your release line: 5.4.4 or 5.5.4.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-94462 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94462 exists.
Sources
Also known as GHSA-4825-p4xm-pcf2.