QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-25758

Back to search

CVE-2026-25758

Published: Feb 6, 2026

Modified: Feb 9, 2026

PUBLISHED

Description

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

VendorProductVersions

spree

spree

affected
< 4.10.3
affected
>= 5.0.0, < 5.0.8
affected
>= 5.1.0.beta, < 5.1.10
affected
>= 5.2.0.rc1, < 5.2.7
affected
>= 5.3.0.rc2, < 5.3.2

Weaknesses (CWE)

CWE-639
CWE-284

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now