Vulnerability-Lookup

CVE-2026-94462 (GCVE-0-2026-94462)

Vulnerability from cvelistv5 – Published: 2026-09-22 18:57 – Updated: 2026-09-22 19:20

Title

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 19:20 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/spree/spree/security/advisorie…	x_refsource_CONFIRM
https://github.com/spree/spree/pull/14314	x_refsource_MISC
https://github.com/spree/spree/commit/8834230a1f4…	x_refsource_MISC
https://github.com/spree/spree/commit/af0d1a2d582…	x_refsource_MISC
https://github.com/spree/spree/releases/tag/v5.4.4	x_refsource_MISC
https://github.com/spree/spree/releases/tag/v5.5.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
spree	spree	Affected: >= 5.4.0, < 5.4.4 Affected: >= 5.5.0, < 5.5.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94462",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T19:20:02.955046Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T19:20:22.173Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spree",
          "vendor": "spree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.4.0, \u003c 5.4.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 5.5.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker\u0027s account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest\u0027s in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T18:57:03.854Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
        },
        {
          "name": "https://github.com/spree/spree/pull/14314",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/pull/14314"
        },
        {
          "name": "https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd"
        },
        {
          "name": "https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8"
        },
        {
          "name": "https://github.com/spree/spree/releases/tag/v5.4.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/releases/tag/v5.4.4"
        },
        {
          "name": "https://github.com/spree/spree/releases/tag/v5.5.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/releases/tag/v5.5.4"
        }
      ],
      "source": {
        "advisory": "GHSA-4825-p4xm-pcf2",
        "discovery": "UNKNOWN"
      },
      "title": "Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-94462",
    "datePublished": "2026-09-22T18:57:03.854Z",
    "dateReserved": "2026-09-21T17:25:42.290Z",
    "dateUpdated": "2026-09-22T19:20:22.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-94462",
      "date": "2026-09-24",
      "epss": "0.0028",
      "percentile": "0.18134"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "spree",
                "vendor": "spree",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 5.4.0, \u003c 5.4.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 5.5.0, \u003c 5.5.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker\u0027s account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest\u0027s in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4."
          }
        ],
        "id": "CVE-2026-94462",
        "lastModified": "2026-09-23T18:12:04.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-94462",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T19:20:02.955046Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-22T19:16:59.497",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/spree/spree/pull/14314"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/spree/spree/releases/tag/v5.4.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/spree/spree/releases/tag/v5.5.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-94462",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-22T19:20:02.955046Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-22T19:20:17.923Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "spree",
              "vendor": "spree",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 5.4.0, \u003c 5.4.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 5.5.0, \u003c 5.5.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker\u0027s account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest\u0027s in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-22T18:57:03.854Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
            },
            {
              "name": "https://github.com/spree/spree/pull/14314",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/spree/spree/pull/14314"
            },
            {
              "name": "https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd"
            },
            {
              "name": "https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8"
            },
            {
              "name": "https://github.com/spree/spree/releases/tag/v5.4.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/spree/spree/releases/tag/v5.4.4"
            },
            {
              "name": "https://github.com/spree/spree/releases/tag/v5.5.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/spree/spree/releases/tag/v5.5.4"
            }
          ],
          "source": {
            "advisory": "GHSA-4825-p4xm-pcf2",
            "discovery": "UNKNOWN"
          },
          "title": "Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-94462",
        "datePublished": "2026-09-22T18:57:03.854Z",
        "dateReserved": "2026-09-21T17:25:42.290Z",
        "dateUpdated": "2026-09-22T19:20:22.173Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-94462

Vulnerability from fkie_nvd - Published: 2026-09-22 19:16 - Updated: 2026-09-23 18:12

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd
	security-advisories@github.com	https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8
	security-advisories@github.com	https://github.com/spree/spree/pull/14314
	security-advisories@github.com	https://github.com/spree/spree/releases/tag/v5.4.4
	security-advisories@github.com	https://github.com/spree/spree/releases/tag/v5.5.4
	security-advisories@github.com	https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "spree",
          "vendor": "spree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.4.0, \u003c 5.4.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 5.5.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker\u0027s account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest\u0027s in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4."
    }
  ],
  "id": "CVE-2026-94462",
  "lastModified": "2026-09-23T18:12:04.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-94462",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-22T19:20:02.955046Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-22T19:16:59.497",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/spree/spree/pull/14314"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/spree/spree/releases/tag/v5.4.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/spree/spree/releases/tag/v5.5.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4825-P4XM-PCF2

Vulnerability from github – Published: 2026-09-22 20:40 – Updated: 2026-09-22 20:40

Summary

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Details

Summary

The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id]) — and omits the authorize!(:update, @cart, cart_token) check that every other action in the controller performs via CartResolvable. Because prefixed IDs are a reversible Sqids encoding of the auto-increment primary key (obfuscation, not a token), an authenticated customer can name arbitrary guest cart IDs, take them over, and read the checkout addresses stored on them. This is broken access control / IDOR, reachable by any low-privilege registered user.

Severity

Requires an authenticated store account and depends on target guest carts already carrying an address and not yet being associated, on a store not running in login_required mode. Confidentiality impact is the driver (guest checkout PII); integrity impact is limited and recoverable (cart reassignment + email overwrite on an in-progress cart). Not Critical: the action is gated behind authentication (PR:L, not PR:N) and constrained by cart state, so it is not anonymously exploitable.

Details

Root cause: associate skips the cart-possession check its sibling actions enforce and trusts a guessable identifier as the sole locator.

Entry point. Spree::Api::V3::Store::CartsController#associate (carts_controller.rb:88-96), guarded only by prepend_before_action :require_authentication!, only: [:index, :associate]. That requires the caller be authenticated; it does not tie the request to a specific guest cart.

# spree/api/app/controllers/spree/api/v3/store/carts_controller.rb:88-96
# PATCH /api/v3/store/carts/:id/associate
def associate
  @cart = find_cart_for_association

  result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)

  if result.success?
    render_cart
  else
    render_service_error(result.error.to_s)
  end
end

Missing check. find_cart_for_association (carts_controller.rb:177-178) resolves any guest cart (user IS NULL) in the store by ID with no authorize!(..., cart_token). Contrast CartResolvable#find_cart!, which binds the token.

# spree/api/app/controllers/spree/api/v3/store/carts_controller.rb:177-178
def find_cart_for_association
  current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])
end

Identifier. prefixed_id is "cart_" + SQIDS.encode([id]) with SQIDS = Sqids.new(min_length: 10) (prefixed_id.rb:17,56) — default alphabet, no salt, no blocklist. Sqids is non-cryptographic and reversible, so candidate IDs are derivable offline from sequential primary keys.

# spree/core/app/models/concerns/spree/prefixed_id.rb:17-56
SQIDS = Sqids.new(min_length: 10)

def prefixed_id
  return nil unless id.present?

  "#{self.class._prefix_id_prefix}_#{Spree::PrefixedId::SQIDS.encode([id])}"
end

Data flow. Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true) reassigns the owner and overwrites email, preserving existing addresses via bill_address ||= / ship_address ||=. render_cart then serializes billing_address/shipping_address (first_name, last_name, address1, address2, city, postal_code, phone, company) back to the caller.

PoC

Preconditions: attacker holds an ordinary store account (self-service registration) and the store's publishable key (a front-end credential, present in any headless storefront bundle); one or more guest carts carry checkout addresses; store is not in login_required mode.

Authenticate: POST /api/v3/store/auth/login → attacker JWT.
Derive candidate IDs offline: "cart_" + Sqids.encode([n]) for a range of n.
For each candidate: PATCH /api/v3/store/carts/<id>/associate with the attacker JWT. A hit returns 200 with the victim's billing_address/shipping_address; non-guest or missing carts return 404/422.

Impact

Confidentiality: an authenticated attacker can enumerate guest cart IDs and read checkout PII (name, street, postal code, phone) on carts they don't own. Integrity: limited and recoverable — each call reassigns the guest cart and overwrites its email, disrupting the original guest's in-progress cart. Requires a registered account, so not anonymously exploitable.

Remediation

Update to Spree 5.4.4 or 5.5.4. Your storefront, based on https://github.com/spree/storefront, doesn't need any updates because it has always sent a cart token when associating carts; this is a backend issue.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.4.0"
            },
            {
              "fixed": "5.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "5.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-94462"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:40:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe Store API v3 endpoint `PATCH /api/v3/store/carts/:id/associate` binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only \u2014 `current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])` \u2014 and omits the `authorize!(:update, @cart, cart_token)` check that every other action in the controller performs via `CartResolvable`. Because prefixed IDs are a reversible Sqids encoding of the auto-increment primary key (obfuscation, not a token), an authenticated customer can name arbitrary guest cart IDs, take them over, and read the checkout addresses stored on them. This is broken access control / IDOR, reachable by any low-privilege registered user.\n\n## Severity\n\nRequires an authenticated store account and depends on target guest carts already carrying an address and not yet being associated, on a store not running in `login_required` mode. Confidentiality impact is the driver (guest checkout PII); integrity impact is limited and recoverable (cart reassignment + email overwrite on an in-progress cart). Not Critical: the action is gated behind authentication (`PR:L`, not `PR:N`) and constrained by cart state, so it is not anonymously exploitable.\n\n## Details\n\n**Root cause:** `associate` skips the cart-possession check its sibling actions enforce and trusts a guessable identifier as the sole locator.\n\n**Entry point.** `Spree::Api::V3::Store::CartsController#associate` (`carts_controller.rb:88-96`), guarded only by `prepend_before_action :require_authentication!, only: [:index, :associate]`. That requires the *caller* be authenticated; it does not tie the request to a specific guest cart.\n\n```ruby\n# spree/api/app/controllers/spree/api/v3/store/carts_controller.rb:88-96\n# PATCH /api/v3/store/carts/:id/associate\ndef associate\n  @cart = find_cart_for_association\n\n  result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)\n\n  if result.success?\n    render_cart\n  else\n    render_service_error(result.error.to_s)\n  end\nend\n```\n\n**Missing check.** `find_cart_for_association` (`carts_controller.rb:177-178`) resolves any guest cart (`user IS NULL`) in the store by ID with no `authorize!(..., cart_token)`. Contrast `CartResolvable#find_cart!`, which binds the token.\n\n```ruby\n# spree/api/app/controllers/spree/api/v3/store/carts_controller.rb:177-178\ndef find_cart_for_association\n  current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])\nend\n```\n\n**Identifier.** `prefixed_id` is `\"cart_\" + SQIDS.encode([id])` with `SQIDS = Sqids.new(min_length: 10)` (`prefixed_id.rb:17,56`) \u2014 default alphabet, no salt, no blocklist. Sqids is non-cryptographic and reversible, so candidate IDs are derivable offline from sequential primary keys.\n\n```ruby\n# spree/core/app/models/concerns/spree/prefixed_id.rb:17-56\nSQIDS = Sqids.new(min_length: 10)\n\ndef prefixed_id\n  return nil unless id.present?\n\n  \"#{self.class._prefix_id_prefix}_#{Spree::PrefixedId::SQIDS.encode([id])}\"\nend\n```\n\n**Data flow.** `Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)` reassigns the owner and overwrites email, preserving existing addresses via `bill_address ||= / ship_address ||=`. `render_cart` then serializes `billing_address`/`shipping_address` (first_name, last_name, address1, address2, city, postal_code, phone, company) back to the caller.\n\n## PoC\n\n**Preconditions:** attacker holds an ordinary store account (self-service registration) and the store\u0027s publishable key (a front-end credential, present in any headless storefront bundle); one or more guest carts carry checkout addresses; store is not in `login_required` mode.\n\n1. Authenticate: `POST /api/v3/store/auth/login` \u2192 attacker JWT.\n2. Derive candidate IDs offline: `\"cart_\" + Sqids.encode([n])` for a range of `n`.\n3. For each candidate: `PATCH /api/v3/store/carts/\u003cid\u003e/associate` with the attacker JWT. A hit returns `200` with the victim\u0027s `billing_address`/`shipping_address`; non-guest or missing carts return `404`/`422`.\n\n## Impact\n\n**Confidentiality:** an authenticated attacker can enumerate guest cart IDs and read checkout PII (name, street, postal code, phone) on carts they don\u0027t own. **Integrity:** limited and recoverable \u2014 each call reassigns the guest cart and overwrites its email, disrupting the original guest\u0027s in-progress cart. Requires a registered account, so not anonymously exploitable.\n\n## Remediation\n\nUpdate to Spree 5.4.4 or 5.5.4. Your storefront, based on https://github.com/spree/storefront, doesn\u0027t need any updates because it has always sent a cart token when associating carts; this is a backend issue.",
  "id": "GHSA-4825-p4xm-pcf2",
  "modified": "2026-09-22T20:40:30Z",
  "published": "2026-09-22T20:40:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/pull/14314"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spree/spree"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/releases/tag/v5.4.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/releases/tag/v5.5.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-94462 (GCVE-0-2026-94462)

FKIE_CVE-2026-94462

GHSA-4825-P4XM-PCF2

Summary

Severity

Details

PoC

Impact

Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour