CVE-2026-25758

HIGH

Spree < 4.10.3 - Unauthenticated Insecure Direct Object Reference in Guest Checkout Address Binding

Title source: llm
STIX 2.1

Description

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

References (10)

Core 10
Core References

Scores

CVSS v3 7.5
EPSS 0.0060
EPSS Percentile 43.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-284 CWE-639
Status published
Products (2)
rubygems/spree_api 0 - 4.10.3RubyGems
spreecommerce/spree < 4.10.3
Published Feb 06, 2026
Tracked Since Feb 18, 2026