CVE-2026-25757

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25757", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T18:35:52.357Z", "datePublished": "2026-02-06T22:37:07.542Z", "dateUpdated": "2026-02-09T15:26:28.967Z"}, "containers": {"cna": {"title": "Unauthenticated Spree Commerce users can view completed guest orders by Order ID", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9"}, {"name": "https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab"}, {"name": "https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be"}, {"name": "https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d"}, {"name": "https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad"}, {"name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14"}, {"name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8"}, {"name": "https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45", "tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45"}], "affected": [{"vendor": "spree", "product": "spree", "versions": [{"version": "< 5.0.8", "status": "affected"}, {"version": ">= 5.1.0, < 5.1.10", "status": "affected"}, {"version": ">= 5.2.0, < 5.2.7", "status": "affected"}, {"version": ">= 5.3.0, < 5.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T22:37:07.542Z"}, "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2."}], "source": {"advisory": "GHSA-p6pv-q7rc-g4h9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:21:52.679647Z", "id": "CVE-2026-25757", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:26:28.967Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25757", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:21:52.679647Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:21:53.488Z"}}], "cna": {"title": "Unauthenticated Spree Commerce users can view completed guest orders by Order ID", "source": {"advisory": "GHSA-p6pv-q7rc-g4h9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "spree", "product": "spree", "versions": [{"status": "affected", "version": "< 5.0.8"}, {"status": "affected", "version": ">= 5.1.0, < 5.1.10"}, {"status": "affected", "version": ">= 5.2.0, < 5.2.7"}, {"status": "affected", "version": ">= 5.3.0, < 5.3.2"}]}], "references": [{"url": "https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9", "name": "https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab", "name": "https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be", "name": "https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d", "name": "https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad", "name": "https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14", "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8", "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45", "name": "https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T22:37:07.542Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25757", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:26:28.967Z", "dateReserved": "2026-02-05T18:35:52.357Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T22:37:07.542Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "spree", "vendor": "spree", "versions": [{"status": "affected", "version": "< 5.0.8"}, {"status": "affected", "version": ">= 5.1.0, < 5.1.10"}, {"status": "affected", "version": ">= 5.2.0, < 5.2.7"}, {"status": "affected", "version": ">= 5.3.0, < 5.3.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "98910FEE-BD94-4433-8F48-2BA39FDFDDB9", "versionEndExcluding": "5.0.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "454F517E-0713-43E7-93A3-5E4B29CCEEB5", "versionEndExcluding": "5.1.10", "versionStartIncluding": "5.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "44109CC9-7DC9-4F90-829A-8C7DBEDD1837", "versionEndExcluding": "5.2.7", "versionStartIncluding": "5.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "06654012-3233-4397-AC59-065A17513649", "versionEndExcluding": "5.3.2", "versionStartIncluding": "5.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2."}, {"lang": "es", "value": "Spree es una soluci\u00f3n de comercio electr\u00f3nico de c\u00f3digo abierto construida con Ruby on Rails. Antes de las versiones 5.0.8, 5.1.10, 5.2.7 y 5.3.2, los usuarios no autenticados pueden ver pedidos de invitados completados mediante el ID de pedido. Este problema puede llevar a la divulgaci\u00f3n de PII de usuarios invitados (incluyendo nombres, direcciones y n\u00fameros de tel\u00e9fono). Este problema ha sido parcheado en las versiones 5.0.8, 5.1.10, 5.2.7 y 5.3.2."}], "id": "CVE-2026-25757", "lastModified": "2026-06-17T10:25:10.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25757", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:21:52.679647Z", "version": "2.0.3"}}]}, "published": "2026-02-06T23:15:54.527", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:19:08.986464+00:00", "value": {"mitigation_remediation": ["Upgrade Spree Commerce to at least version 5.0.8 (or the corresponding patched releases 5.1.10, 5.2.7, 5.3.2).", "Ensure that the orders API requires authentication or at least restricts access to the owner\u2019s own orders.", "Obfuscate or randomize order identifiers to mitigate straightforward enumeration attacks."], "summary": {"action": "Patch", "impact": "PII disclosure"}, "threat_synthesis": {"affected_systems": "Spree Commerce versions prior to 5.0.8, 5.1.10, 5.2.7, and 5.3.2 expose this flaw. Those releases allow any user to view guest order details because the Orders controller and number generator lack proper authorization safeguards.", "description_and_impact": "Unauthenticated users can retrieve any completed guest order by providing its Order ID to the Spree Orders controller. The vulnerability arises because the controller does not enforce authentication or access checks for these orders, allowing disclosure of personally identifiable information such as names, addresses, and phone numbers. The weakness corresponds to CWE-639, Information Exposure from Public Endpoints. The likely attack vector is an HTTP request to the order endpoint, which the controller currently serves without requiring login or permission checks.", "risk_and_exploitability": "The CVSS score of 7.7 signals high confidentiality impact, while the EPSS score of <1% indicates a low probability of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog, implying no large\u2011scale exploitation campaigns are known. Nevertheless, the flaw can be exploited trivially by guessing or enumerating order identifiers, potentially exposing dozens or hundreds of guest orders to unauthenticated parties."}}}}, "created": "2026-02-09T10:44:58.633918+00:00", "title": "Unauthenticated Access to Guest Orders Allows PII Disclosure", "updated": "2026-04-17T22:30:29.587637+00:00", "vendors": ["spree", "spree$PRODUCT$spree"]}