PT-2026-2215 · Spree · Spree

Damianlegawiec · Published 2026-01-08 · Updated 2026-01-22 · CVE-2026-22589

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spree versions prior to 4.10.2 Spree versions prior to 5.0.7 Spree versions prior to 5.1.9 Spree versions prior to 5.2.5

Description Spree is an open source e-commerce solution built with Ruby on Rails. An unauthenticated Insecure Direct Object Reference (IDOR) issue exists, allowing an attacker to access guest address information without valid credentials or session cookies. The issue affects the Spree API. An IDOR occurs when an application provides direct access to objects based on user-supplied input. In this case, an attacker can manipulate the input to access data belonging to other users. The vulnerable component allows access to guest address information.

Recommendations Update Spree to version 4.10.2 or later. Update Spree to version 5.0.7 or later. Update Spree to version 5.1.9 or later. Update Spree to version 5.2.5 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-22589

GHSA-3GHG-3787-W2XR

Affected Products

Spree

References · 17

• 🔥 https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22589.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml · Exploit
• https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795 · Patch
• https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67 · Patch
• https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad · Patch
• https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad · Patch
• https://osv.dev/vulnerability/GHSA-3ghg-3787-w2xr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22589 · Security Note
• https://github.com/spree/spree · Note
• https://t.me/CVEtracker/41912 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009892318115991921 · Twitter Post
• https://t.me/cveNotify/149542 · Telegram Post
• https://twitter.com/rubylandnews/status/2010099420835049716 · Twitter Post