Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Obje…

CVE-2026-22589 is an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in Spree, an open source e-commerce solution built with Ruby on Rails. The vulnerability allows unauthenticated attackers to access guest address information without valid credentials or session cookies. Multiple versions are affected including versions prior to 4.10.2, 5.0.7, 5.1.9, and 5.2.5. The issue has been patched in the specified versions. This represents a significant privacy breach risk for e-commerce platforms using vulnerable Spree versions.