CVE-2026-22589

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22589", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T21:50:39.532Z", "datePublished": "2026-01-10T03:17:58.494Z", "dateUpdated": "2026-01-12T17:32:46.777Z"}, "containers": {"cna": {"title": "Spree API has Unauthenticated IDOR - Guest Address", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr"}, {"name": "https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795"}, {"name": "https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad"}, {"name": "https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67"}, {"name": "https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad"}], "affected": [{"vendor": "spree", "product": "spree", "versions": [{"version": ">= 5.2.0, < 5.2.5", "status": "affected"}, {"version": ">= 5.1.0, < 5.1.9", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.7", "status": "affected"}, {"version": "< 4.10.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T03:17:58.494Z"}, "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5."}], "source": {"advisory": "GHSA-3ghg-3787-w2xr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T17:32:40.770165Z", "id": "CVE-2026-22589", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T17:32:46.777Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22589", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T17:32:40.770165Z"}}}], "references": [{"url": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T17:32:30.343Z"}}], "cna": {"title": "Spree API has Unauthenticated IDOR - Guest Address", "source": {"advisory": "GHSA-3ghg-3787-w2xr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "spree", "product": "spree", "versions": [{"status": "affected", "version": ">= 5.2.0, < 5.2.5"}, {"status": "affected", "version": ">= 5.1.0, < 5.1.9"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.7"}, {"status": "affected", "version": "< 4.10.2"}]}], "references": [{"url": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr", "name": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795", "name": "https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad", "name": "https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67", "name": "https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad", "name": "https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T03:17:58.494Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22589", "state": "PUBLISHED", "dateUpdated": "2026-01-12T17:32:46.777Z", "dateReserved": "2026-01-07T21:50:39.532Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T03:17:58.494Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "spree", "vendor": "spree", "versions": [{"status": "affected", "version": ">= 5.2.0, < 5.2.5"}, {"status": "affected", "version": ">= 5.1.0, < 5.1.9"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.7"}, {"status": "affected", "version": "< 4.10.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "B265915C-3AA8-4B6C-9794-DA08F6359D31", "versionEndExcluding": "4.10.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6C152A8-FCA5-4420-A138-E09B27970EE4", "versionEndExcluding": "5.0.7", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "54EEC933-938E-404B-A87B-3771931D5E23", "versionEndExcluding": "5.1.9", "versionStartIncluding": "5.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C6D055D-A9A8-46E1-A16C-FE17B66E800B", "versionEndExcluding": "5.2.5", "versionStartIncluding": "5.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5."}, {"lang": "es", "value": "Spree es una soluci\u00f3n de comercio electr\u00f3nico de c\u00f3digo abierto construida con Ruby on Rails. Antes de las versiones 4.10.2, 5.0.7, 5.1.9 y 5.2.5, se identific\u00f3 una vulnerabilidad de Referencia Directa a Objeto Insegura No Autenticada (IDOR) que permite a un atacante no autenticado acceder a informaci\u00f3n de direcci\u00f3n de invitado sin proporcionar credenciales v\u00e1lidas o cookies de sesi\u00f3n. Este problema ha sido parcheado en las versiones 4.10.2, 5.0.7, 5.1.9 y 5.2.5."}], "id": "CVE-2026-22589", "lastModified": "2026-06-17T10:20:07.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22589", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T17:32:40.770165Z", "version": "2.0.3"}}]}, "published": "2026-01-10T04:16:01.343", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:13:34.393956+00:00", "value": {"mitigation_remediation": ["Upgrade to Spree versions 4.10.2, 5.0.7, 5.1.9, 5.2.5 or later, which contain the fix.", "If an upgrade is not immediately possible, restrict unauthenticated access to the guest address API endpoints by enabling authentication checks or applying firewall rules to block non\u2011authenticated traffic.", "Configure application logs to detect and alert on repeated unauthenticated access attempts to address endpoints, and review for any unauthorized data disclosures."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated IDOR leading to guest address disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Spree Commerce versions earlier than 4.10.2, 5.0.7, 5.1.9, and 5.2.5. Systems running any of these releases are at risk unless upgraded to the patched versions, which are 4.10.2, 5.0.7, 5.1.9, 5.2.5 or newer releases.", "description_and_impact": "A flaw in the Spree API allows any unauthenticated actor to read guest address information via insecure direct object references. The vulnerability is based on improper access control and falls under the CWE-639 weak authentication category. An attacker can exploit this to obtain personally identifying information about site visitors without providing credentials, which could be used for phishing or other social engineering attacks.", "risk_and_exploitability": "The CVSS score of 7.5 places the issue in the high severity range, though the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would involve sending direct HTTP requests to the address endpoints exposed by the API, requiring no authentication or session context. The attack path is shallow and does not depend on complex prerequisites, making it easy to execute if an attacker discovers the endpoint."}}}}, "created": "2026-01-12T14:36:46.557810+00:00", "updated": "2026-04-18T07:15:25.859816+00:00", "vendors": ["spree", "spree$PRODUCT$spree"]}