← Vulnerability feed

Vulnerability record · CVE-2026-22589 · published 10 January 2026

CVE-2026-22589: Spreecommerce spree insecure direct object reference vulnerability

Spreecommerce · Spree

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.

7.5 CVSS 3.1 High EPSS 0.44% · top 64.6% CWE-639 · Insecure direct object reference
7.5CVSS 3.1 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795 Patch
https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad Patch
https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67 Patch
https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad Patch
https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr ExploitVendor Advisory
https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr ExploitVendor Advisory

Track CVE-2026-22589 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2011-10019Spreecommerce spree code injection vulnerabilitySpreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to proper…EPSS 4.0%9.3CVE-2011-10026Spreecommerce spree os command injection vulnerabilitySpreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation …EPSS 2.6%7.7CVE-2026-25757Spreecommerce spree insecure direct object reference vulnerabilitySpree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can vi…EPSS 0.50%7.7CVE-2026-25758Spreecommerce spree improper access control vulnerabilitySpree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow th…EPSS 0.69%6.5CVE-2026-22588Spreecommerce spree insecure direct object reference vulnerabilitySpree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Di…EPSS 0.41%6.5CVE-2020-26223Spreecommerce spree incorrect authorization vulnerabilitySpree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12…EPSS 1.1%5.0CVE-2008-7310Spreecommerce spree vulnerabilitySpree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order s…EPSS 1.2%5.0CVE-2008-7311Spreecommerce spree vulnerabilityThe session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it …EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2026-22589), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.