CVE-2026-25758
Unknown Unknown - Not Provided
IDOR in Spree Commerce Guest Checkout Exposes PII

Publication date: 2026-02-06

Last updated on: 2026-02-19

Assigner: GitHub, Inc.

Description
Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-06
Last Modified
2026-02-19
Generated
2026-06-16
AI Q&A
2026-02-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25758
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
spreecommerce spree From 5.1.0 (inc) to 5.1.10 (exc)
spreecommerce spree From 5.2.0 (inc) to 5.2.7 (exc)
spreecommerce spree From 5.3.0 (inc) to 5.3.2 (exc)
spreecommerce spree to 4.10.3 (exc)
spreecommerce spree From 5.0.0 (inc) to 5.0.8 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a critical Insecure Direct Object Reference (IDOR) in Spree Commerce's guest checkout flow. It allows any guest user to manipulate address ID parameters to bind arbitrary guest addresses to their order.

As a result, unauthorized users can access other guests' personally identifiable information (PII), such as names, addresses, and phone numbers, bypassing existing ownership validation checks.

This issue affects all guest checkout transactions and has been fixed in versions 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2 of Spree Commerce.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive personal information of other customers, including their names, addresses, and phone numbers.

Such exposure of personally identifiable information (PII) can result in privacy breaches, identity theft, and loss of customer trust.

Additionally, it can damage the reputation of the affected e-commerce platform and potentially lead to legal and financial consequences.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Spree Commerce to one of the fixed versions: 4.10.3, 5.0.8, 5.1.10, 5.2.7, or 5.3.2.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25758. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart