Home

Description

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

PUBLISHED Reserved 2026-02-05 | Published 2026-02-06 | Updated 2026-02-09 | Assigner GitHub_M




HIGH: 7.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

< 5.0.8
affected

>= 5.1.0, < 5.1.10
affected

>= 5.2.0, < 5.2.7
affected

>= 5.3.0, < 5.3.2
affected

References

github.com/.../spree/security/advisories/GHSA-p6pv-q7rc-g4h9

github.com/...ommit/3e00be64c128ef4bd4b99731f0c3ab469509cfab

github.com/...ommit/6b32ed7d474aa55fa441990e6aa39740152aa1be

github.com/...ommit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d

github.com/...ommit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad

github.com/...ont/app/controllers/spree/orders_controller.rb

github.com/...ont/app/controllers/spree/orders_controller.rb

github.com/...e3d7cc/core/lib/spree/core/number_generator.rb

cve.org (CVE-2026-25757)

nvd.nist.gov (CVE-2026-25757)

Download JSON