https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 20:56:04 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-60996 cnvd-2020-60996 https://cve.radiocsirt.org/vuln/cnvd-2020-60996 https://cve.radiocsirt.org/vuln/euvd-2026-42798 EUVD-2026-42798 https://cve.radiocsirt.org/vuln/euvd-2026-42798 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15269 <p>In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.</p> <p>In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-15269 https://cve.radiocsirt.org/vuln/ghsa-f8cm-364f-q9qh <p><strong>Affected:</strong> RubyGems: spree</p> <p>### Impact The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints.</p> <p>### Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.</p> <p>### Workarounds In your project directory create a decorator file `app/controllers/spree/api/v2/base_controller_decotatror.rb` with contents:</p> <p>```ruby module Spree module Api module V2 module BaseControllerDecorator private</p> <p>def spree_current_user return nil unless doorkeeper_token return @spree_current_user if @spree_current_user</p> <p>doorkeeper_authorize!</p> <p>@spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id) end end end end</p> <p>Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator) ```</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)</p> <p><strong>Affected:</strong> RubyGems: spree</p> <p>### Impact The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints.</p> <p>### Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.</p> <p>### Workarounds In your project directory create a decorator file `app/controllers/spree/api/v2/base_controller_decotatror.rb` with contents:</p> <p>```ruby module Spree module Api module V2 module BaseControllerDecorator private</p> <p>def spree_current_user return nil unless doorkeeper_token return @spree_current_user if @spree_current_user</p> <p>doorkeeper_authorize!</p> <p>@spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id) end end end end</p> <p>Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator) ```</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)</p> https://cve.radiocsirt.org/vuln/ghsa-f8cm-364f-q9qh https://cve.radiocsirt.org/vuln/gsd-2020-15269 gsd-2020-15269 https://cve.radiocsirt.org/vuln/gsd-2020-15269