https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T02:25:28.086133+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-66283 cnvd-2020-66283 2026-10-05T02:25:28.089331+00:00 cnvd-2020-66283 https://cve.radiocsirt.org/vuln/euvd-2026-45974 EUVD-2026-45974 2026-10-05T02:25:28.089362+00:00 EUVD-2026-45974 https://cve.radiocsirt.org/vuln/fkie_cve-2020-26223 fkie_cve-2020-26223 2026-10-05T02:25:28.089376+00:00

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

 https://cve.radiocsirt.org/vuln/ghsa-m2jr-hmc3-qmpr GHSA-m2jr-hmc3-qmpr — Authorization bypass in Spree 2026-10-05T02:25:28.089406+00:00

Affected: RubyGems: spree_api

### Impact The perpetrator could query the [API v2 Order Status](https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status) endpoint with an empty string passed as an Order token

### Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

### References Pull request with a fix and in-depth explanation - https://github.com/spree/spree/pull/10573

### For more information If you have any questions or comments about this advisory: * Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)

 https://cve.radiocsirt.org/vuln/gsd-2020-26223 gsd-2020-26223 2026-10-05T02:25:28.089436+00:00 gsd-2020-26223