{"vulnerability": "CVE-2026-94462", "sightings": [{"uuid": "670a6a28-e724-4286-aac4-529f27c206ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94462", "type": "published-proof-of-concept", "source": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2", "content": "", "creation_timestamp": "2026-09-22T22:35:12.103035Z"}, {"uuid": "f3548288-790a-4c40-8199-8530712e09db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94462", "type": "seen", "source": "https://gist.github.com/alon710/0f041c2843a6a8b00e2f4484b53f3243", "content": "# CVE-2026-94462: CVE-2026-94462: Broken Access Control in Spree Store API v3 Cart Association\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-94462\n\n## Summary\nAn Insecure Direct Object Reference (IDOR) vulnerability exists in Spree open-source e-commerce solution versions 5.4.0 through 5.4.3 and 5.5.0 through 5.5.3. An authenticated attacker can predict or enumerate guest cart identifiers generated via Sqids and associate them with their own account. This unauthorized association leaks sensitive customer personally identifiable information (PII) and disrupts the checkout flow of active guest sessions.\n\n## TL;DR\nAuthenticated attackers can hijack arbitrary guest carts and leak customer PII by exploiting guessable cart IDs and a lack of token verification in the Spree Store API cart association endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS Score**: 7.1\n- **EPSS Score**: N/A\n- **Impact**: Confidentiality (High), Integrity (Low)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Spree >= 5.4.0, < 5.4.4\n- Spree >= 5.5.0, < 5.5.4\n- **Spree**: >= 5.4.0, < 5.4.4 (Fixed in: `5.4.4`)\n- **Spree**: >= 5.5.0, < 5.5.4 (Fixed in: `5.5.4`)\n\n## Mitigation\n\n- Upgrade Spree to patched versions (5.4.4 or 5.5.4)\n- Implement Web Application Firewall (WAF) rules to block cart association requests lacking the x-spree-token header\n- Monitor API logs for anomalous cart association requests from single accounts\n\n**Remediation Steps:**\n1. Identify the currently deployed Spree version in the Gemfile.\n2. Update the spree dependency to version 5.4.4 (for 5.4.x installs) or 5.5.4 (for 5.5.x installs).\n3. Run 'bundle update spree' to apply the patch.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-4825-p4xm-pcf2](https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2)\n- [Spree Pull Request #14314](https://github.com/spree/spree/pull/14314)\n- [Spree v5.4.4 Release Tag](https://github.com/spree/spree/releases/tag/v5.4.4)\n- [Spree v5.5.4 Release Tag](https://github.com/spree/spree/releases/tag/v5.5.4)\n- [NVD Record for CVE-2026-94462](https://nvd.nist.gov/vuln/detail/CVE-2026-94462)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-94462) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T06:31:30.662745Z"}]}