IDOR Vulnerability in Spree Commerce's Guest Checkout Flow
CVE-2026-25758
7.7HIGH
What is CVE-2026-25758?
An IDOR vulnerability in Spree Commerce's guest checkout process allows attackers to bind arbitrary guest addresses to their orders by manipulating address ID parameters. This vulnerability enables unauthorized access to personally identifiable information (PII) of other guests, including names, addresses, and phone numbers. The issue arises from a failure to validate the ownership of address records during the guest checkout process, affecting all transactions processed in this manner. The vulnerability has been addressed in specific versions: 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
Affected Version(s)
spree < 4.10.3 < 4.10.3
spree >= 5.0.0, < 5.0.8 < 5.0.0, 5.0.8
spree >= 5.1.0.beta, < 5.1.10 < 5.1.0.beta, 5.1.10