CVE-2026-94462 in Spree
Summary
by MITRE • 09/22/2026
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified as CVE-2023-46718 represents a significant security flaw within Spree, an open-source e-commerce platform developed using the Ruby on Rails framework. This issue specifically affects versions ranging from 5.4.0 up to and including 5.4.4, as well as version 5.5.4. The core of the problem lies in the implementation of the PATCH /api/v3/store/carts/:id/associate endpoint within the Spree::Api::V3::Store::CartsController#associate method. This API endpoint is designed to allow authenticated users to associate a guest cart with their permanent account, thereby preserving items and details during checkout processes that might otherwise require login. However, the underlying logic relies on the find_cart_for_association function to locate a specific cart based solely on its prefixed_id parameter provided by the client request.
The fundamental technical flaw is an absence of proper access control verification regarding ownership or possession of the target guest cart. When an authenticated user submits a request with a prefixed_id, the system retrieves the corresponding cart object without requiring any proof that the requester actually owns or has permission to modify this specific guest session data. In secure systems, such operations typically require a unique token associated with the guest session to ensure that only the individual currently interacting with that guest cart can merge it into their account. By omitting this verification step, the application fails to enforce proper authorization checks, allowing any authenticated user to manipulate carts belonging to other users or anonymous visitors.
This lack of ownership validation enables a severe information disclosure attack vector. An attacker who is an authenticated customer on the same store platform can exploit this flaw by deriving reversible prefixed cart IDs. These identifiers are not cryptographically random and can be predicted or calculated based on known patterns within the system. Once the attacker identifies a valid guest cart ID, they can send a PATCH request to associate that specific guest cart with their own account. Upon successful association, the API returns comprehensive data associated with the victim's guest session, including sensitive personally identifiable information such as billing and shipping addresses. This constitutes a direct violation of user privacy and exposes customers to potential identity theft or targeted phishing attacks based on their location and purchasing habits.
Beyond the immediate risk of data exfiltration, this vulnerability also facilitates denial-of-service conditions against other users. Because associating a guest cart with an account effectively transfers ownership and potentially clears or locks the original session state for the legitimate user, an attacker can disrupt the shopping experience of others. If a victim is in the middle of checking out on their device while holding items in that specific guest cart, the unauthorized reassignment by an attacker could cause the system to lose track of the active session, resulting in lost items or requiring the customer to restart their purchase process entirely. This impacts business continuity and erodes trust in the platform's reliability for high-value transactions.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, specifically reflecting failures in authorization logic where users can access resources belonging to other entities without proper permission checks. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on legitimate authentication credentials to perform unauthorized actions against shared or public-facing resources like guest carts. The attack pattern resembles IDOR (Insecure Direct Object Reference) where the object identifier is used without sufficient validation of the relationship between the actor and the resource.
To mitigate this vulnerability, organizations running affected versions of Spree must upgrade immediately to version 5.4.4 or later, which includes patches for these authorization checks. For environments that cannot be upgraded instantly due to compatibility constraints with other dependencies, temporary mitigations should focus on restricting access to the associate endpoint if possible, although API-level restrictions are often difficult to implement without code changes. Additionally, implementing strict rate limiting and monitoring for unusual patterns of cart association requests can help detect potential exploitation attempts in real-time. It is also advisable to review any custom integrations that rely on this specific API behavior to ensure they do not inadvertently expose similar weaknesses elsewhere in the application logic. Ensuring that all guest sessions are tied to unique, unpredictable tokens before allowing them to be merged into authenticated accounts is critical for maintaining data integrity and user privacy in e-commerce platforms.