https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:05:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267666 EUVD-2026-267666 https://cve.radiocsirt.org/vuln/euvd-2026-267666 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25758 <p>Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce&#39;s guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests&#39; personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.</p> <p>Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce&#39;s guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests&#39; personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25758 https://cve.radiocsirt.org/vuln/ghsa-87fh-rc96-6fr6 <p><strong>Affected:</strong> RubyGems: spree_api</p> <p>### Summary A critical IDOR vulnerability exists in Spree Commerce&#39;s guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests&#39; personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.</p> <p>### Impact This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).</p> <p>### Unauthenticated users can access all guest addresses (`GHSL-2026-027`)</p> <p>The vulnerability stems from incomplete authorization validation in Spree&#39;s checkout address assignment logic. While nested address attributes (`bill_address_attributes[id]` and `ship_address_attributes[id]`) are properly validated through `validate_address_ownership`, plain ID parameters (`bill_address_id` and `ship_address_id`) bypass this check entirely. Since Spree&#39;s address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.</p> <p>### Affected Code Components</p> <p>1. **Permitted Attributes** ([`core/lib/spree/permitted_attributes.rb:92–96`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96)) - Allows `bill_address_id` and `ship_address_id` as permitted parameters without validation</p> <p>2. **Checkout Update** ([`core/app/mode…</p> <p><strong>Affected:</strong> RubyGems: spree_api</p> <p>### Summary A critical IDOR vulnerability exists in Spree Commerce&#39;s guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests&#39; personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.</p> <p>### Impact This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).</p> <p>### Unauthenticated users can access all guest addresses (`GHSL-2026-027`)</p> <p>The vulnerability stems from incomplete authorization validation in Spree&#39;s checkout address assignment logic. While nested address attributes (`bill_address_attributes[id]` and `ship_address_attributes[id]`) are properly validated through `validate_address_ownership`, plain ID parameters (`bill_address_id` and `ship_address_id`) bypass this check entirely. Since Spree&#39;s address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.</p> <p>### Affected Code Components</p> <p>1. **Permitted Attributes** ([`core/lib/spree/permitted_attributes.rb:92–96`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96)) - Allows `bill_address_id` and `ship_address_id` as permitted parameters without validation</p> <p>2. **Checkout Update** ([`core/app/mode…</p> https://cve.radiocsirt.org/vuln/ghsa-87fh-rc96-6fr6