Spree up to 5.4.3/5.5.3 Cart Association associate CartsController#associate prefixed_id privileges management

Summaryinfo

A vulnerability classified as critical has been found in Spree up to 5.4.3/5.5.3. This impacts the function Spree::Api::V3::Store::CartsController#associate of the file /api/v3/store/carts/:id/associate of the component Cart Association. The manipulation of the argument prefixed_id leads to privileges management. This vulnerability is traded as CVE-2026-94462. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Spree up to 5.4.3/5.5.3 and classified as critical. This issue affects the function Spree::Api::V3::Store::CartsController#associate of the file /api/v3/store/carts/:id/associate of the component Cart Association. The manipulation of the argument prefixed_id with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-94462 since 09/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 5.4.4 or 5.5.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Spree

Version

• 5.4.0
• 5.4.1
• 5.4.2
• 5.4.3
• 5.5.0
• 5.5.1
• 5.5.2
• 5.5.3

Website

• Product: https://github.com/spree/spree/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion