Overview
Spree is an open source e-commerce platform built on Ruby on Rails. When a logged-in user updates an order through the API, Spree accepts a billing or shipping address ID without checking that the address belongs to that user.
An authenticated attacker swaps in another customer's address ID and the API attaches that address to their own order, returning the full record. Walking the ID space exposes names and street addresses across the store. Fixed in Spree 4.10.2, 5.0.7, 5.1.9 and 5.2.5.
Affected products
- Spree before 4.10.2
- Spree 5.0 before 5.0.7
- Spree 5.1 before 5.1.9
- Spree 5.2 before 5.2.5
Disclosure timeline
- 08 Jan 2026
- GitHub advisory and CVE-2026-22588 published; fixed releases available