spree vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20211
3. 20265

Newest CVEs

• CVE-2026-94462

  Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

  spree · spree

  High7.1
• CVE-2026-25757

  Unauthenticated Spree Commerce users can view completed guest orders by Order ID

  spree · spree

  High7.7
• CVE-2026-25758

  Spree allows unauthenticated users can access all guest addresses

  spree · spree

  High7.7
• CVE-2026-22589

  Spree API has Unauthenticated IDOR - Guest Address

  spree · spree

  High7.5
• CVE-2026-22588

  Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

  spree · spree

  Medium6.5
• CVE-2021-41275

  Authentication Bypass by CSRF Weakness

  spree · spree_auth_devise

  Critical9.3
• CVE-2020-26223

  Authorization bypass in Spree

  spree · spree

  High7.7
• CVE-2020-15269

  Expired token reuse in Spree

  spree · spree

  High7.4