CVE-2026-22589-nvd.nist.gov-Received

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Obje…

Published:

9 January 2026 at 23:00:00

Alert date:

10 January 2026 at 13:10:58

Source:

nvd.nist.gov

CVE-2026-22589 is an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in Spree, an open source e-commerce solution built with Ruby on Rails. The vulnerability allows unauthenticated attackers to access guest address information without valid credentials or session cookies. Multiple versions are affected including versions prior to 4.10.2, 5.0.7, 5.1.9, and 5.2.5. The issue has been patched in the specified versions. This represents a significant privacy breach risk for e-commerce platforms using vulnerable Spree versions.

Technical details

Mitigation steps:

Affected products:

Spree Commerce