CVE-2026-22588

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22588", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T21:50:39.531Z", "datePublished": "2026-01-08T20:53:37.110Z", "dateUpdated": "2026-01-08T21:08:53.049Z"}, "containers": {"cna": {"title": "Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j"}, {"name": "https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72"}, {"name": "https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3"}, {"name": "https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8"}, {"name": "https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7"}], "affected": [{"vendor": "spree", "product": "spree", "versions": [{"version": ">= 5.2.0, < 5.2.5", "status": "affected"}, {"version": ">= 5.1.0, < 5.1.9", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.7", "status": "affected"}, {"version": "< 4.10.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T20:53:37.110Z"}, "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users\u2019 address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker\u2019s order and returning them in the response. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5."}], "source": {"advisory": "GHSA-g268-72p7-9j6j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T21:08:29.340173Z", "id": "CVE-2026-22588", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T21:08:53.049Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22588", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T21:08:29.340173Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T21:08:40.336Z"}}], "cna": {"title": "Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification", "source": {"advisory": "GHSA-g268-72p7-9j6j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "spree", "product": "spree", "versions": [{"status": "affected", "version": ">= 5.2.0, < 5.2.5"}, {"status": "affected", "version": ">= 5.1.0, < 5.1.9"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.7"}, {"status": "affected", "version": "< 4.10.2"}]}], "references": [{"url": "https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j", "name": "https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72", "name": "https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3", "name": "https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8", "name": "https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7", "name": "https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users\u2019 address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker\u2019s order and returning them in the response. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T20:53:37.110Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22588", "state": "PUBLISHED", "dateUpdated": "2026-01-08T21:08:53.049Z", "dateReserved": "2026-01-07T21:50:39.531Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T20:53:37.110Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "spree", "vendor": "spree", "versions": [{"status": "affected", "version": ">= 5.2.0, < 5.2.5"}, {"status": "affected", "version": ">= 5.1.0, < 5.1.9"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.7"}, {"status": "affected", "version": "< 4.10.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "B265915C-3AA8-4B6C-9794-DA08F6359D31", "versionEndExcluding": "4.10.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6C152A8-FCA5-4420-A138-E09B27970EE4", "versionEndExcluding": "5.0.7", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "54EEC933-938E-404B-A87B-3771931D5E23", "versionEndExcluding": "5.1.9", "versionStartIncluding": "5.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C6D055D-A9A8-46E1-A16C-FE17B66E800B", "versionEndExcluding": "5.2.5", "versionStartIncluding": "5.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users\u2019 address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker\u2019s order and returning them in the response. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5."}, {"lang": "es", "value": "Spree es una soluci\u00f3n de comercio electr\u00f3nico de c\u00f3digo abierto construida con Ruby on Rails. Antes de las versiones 4.10.2, 5.0.7, 5.1.9 y 5.2.5, se identific\u00f3 una vulnerabilidad de Referencia Directa Insegura a Objeto Autenticada (IDOR) que permite a un usuario autenticado recuperar la informaci\u00f3n de direcci\u00f3n de otros usuarios modificando un pedido existente. Al editar un pedido que poseen leg\u00edtimamente y manipular los identificadores de direcci\u00f3n en la solicitud, el servidor de backend acepta y procesa referencias a direcciones que pertenecen a otros usuarios, asociando posteriormente esas direcciones con el pedido del atacante y devolvi\u00e9ndolas en la respuesta. Este problema ha sido parcheado en las versiones 4.10.2, 5.0.7, 5.1.9 y 5.2.5."}], "id": "CVE-2026-22588", "lastModified": "2026-06-17T10:20:07.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22588", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T21:08:29.340173Z", "version": "2.0.3"}}]}, "published": "2026-01-08T21:15:44.560", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:31:49.974300+00:00", "value": {"mitigation_remediation": ["Upgrade to the patched releases (Spree 4.10.2 or newer, 5.0.7 or newer, 5.1.9 or newer, 5.2.5 or newer).", "If an upgrade cannot be performed immediately, add server\u2011side validation that ensures address identifiers supplied in an order modification belong to the current user, rejecting any foreign references.", "Audit order\u2011modification logs for anomalous address changes and review user permissions to limit excessive order\u2011editing rights."], "summary": {"action": "Apply Patch", "impact": "Confidentiality breach of user address information via authenticated IDOR"}, "threat_synthesis": {"affected_systems": "The issue affects Spree versions earlier than 4.10.2, 5.0.7, 5.1.9, and 5.2.5. Any deployment using those releases and allowing authenticated users to create or modify orders is potentially impacted. The solution is available in the released patches for each of those specific major releases.", "description_and_impact": "Spree, an open\u2011source e\u2011commerce platform built with Ruby on Rails, contains an authenticated Insecure Direct Object Reference that lets a user alter their own order and replace the address identifiers in the request with those belonging to another user. The backend accepts the foreign identifiers, associates the other user\u2019s addresses with the requester\u2019s order, and returns them in the response, exposing private address details. This flaw is a CWE\u2011639 type of vulnerability that compromises confidentiality of personal data.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1\u202f% suggests a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, reducing immediate threat. Exploitation requires valid user authentication and the ability to modify an order; no additional privileges are required. Once the attack is carried out, the attacker receives sensitive delivery address data that could be used for identity theft or targeted fraud."}}}}, "created": "2026-01-09T13:24:13.772130+00:00", "updated": "2026-04-18T07:45:24.971553+00:00", "vendors": ["spree", "spree$PRODUCT$spree"]}