Overview
Spree's storefront API lets guest shoppers check out without an account. The endpoint that reads address records trusts the address ID in the request and does not tie it to the guest's order token or any session.
An attacker with no credentials and no cookies requests address IDs in sequence and reads every guest customer's name and street address. The GitHub advisory rates it 7.5 High. Fixed in Spree 4.10.2, 5.0.7, 5.1.9 and 5.2.5.
Affected products
- Spree before 4.10.2
- Spree 5.0 before 5.0.7
- Spree 5.1 before 5.1.9
- Spree 5.2 before 5.2.5
Disclosure timeline
- 10 Jan 2026
- GitHub advisory and CVE-2026-22589 published; fixed releases available