Spree up to 5.3.1 address ID authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in Spree up to 4.10.2/5.0.7/5.1.9/5.2.6/5.3.1. This affects an unknown part. The manipulation of the argument address ID results in authorization. This vulnerability was named CVE-2026-25758. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Spree up to 4.10.2/5.0.7/5.1.9/5.2.6/5.3.1. Affected is some unknown functionality. The manipulation of the argument address ID with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality. CVE summarizes:

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-25758 since 02/05/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 4.10.3, 5.0.8, 5.1.10, 5.2.7 or 5.3.2 eliminates this vulnerability. Applying the patch 15619618e43b367617ec8d2d4aafc5e54fa7b734 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-5563). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Spree

Version

• 4.10.0
• 4.10.1
• 4.10.2
• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.3.0
• 5.3.1

License

• open-source

Website

• Product: https://github.com/spree/spree/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion