CVE-2026-94462
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| NVDNVD · Awaiting Analysis | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.38% · top 67% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- RubyGemsspree_apiGHSA-4825-p4xm-pcf2 (opens in a new tab)
References (6)
- https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2 (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/spree/spree/pull/14314 (opens in a new tab)x_refsource_MISC
- https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd (opens in a new tab)x_refsource_MISC
- https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8 (opens in a new tab)x_refsource_MISC
- https://github.com/spree/spree/releases/tag/v5.4.4 (opens in a new tab)x_refsource_MISC
- https://github.com/spree/spree/releases/tag/v5.5.4 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-4825-p4xm-pcf2 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-94462)Record last updated .