CVE-2026-94462
Received Received - Intake

Cart Association Vulnerability in Spree E-Commerce Platform

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-94462
EUVD
EUVD-2026-84794

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
spree spree to 5.4.4 (inc)
spree spree From 5.4.0 (inc) to 5.4.4 (inc)
spree spree 5.5.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control issue in the Spree e-commerce platform affecting the Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate. It allows an authenticated attacker to associate guest carts to their own account without proper authorization. The endpoint locates guest carts by a prefixed ID without verifying ownership or requiring a cart token. An attacker can exploit this by guessing valid cart IDs, taking over guest carts, and accessing sensitive checkout information such as billing and shipping addresses.

Detection Guidance

To detect this vulnerability, check Spree versions for affected releases (5.4.0 to 5.4.4 and 5.5.0 to 5.5.4). Inspect API logs for PATCH requests to /api/v3/store/carts/:id/associate without x-spree-token headers. Look for unusual cart associations or unauthorized access to guest cart data.

Impact Analysis

An authenticated attacker could access personally identifiable information (PII) like billing and shipping addresses from guest carts. They could also disrupt the guest's in-progress cart by reassigning it. Exploitation requires a guest cart with address data on a store that does not require login for checkout.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Exposure of billing and shipping addresses may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade Spree to versions 5.4.4 or 5.5.4 immediately using bundle update. Ensure the x-spree-token header is required for cart association endpoints. Verify JWT authentication and token validation in API requests. Disable guest carts if not required or enforce login for checkout.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart