CVE-2026-22588 Details
Description
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker’s order and returning them in the response. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
A vulnerability allowing authenticated users to exploit Insecure Direct Object Reference (IDOR) by accessing other users' address details through unauthorized order modifications. This issue affects Spree versions prior to 4.10.2, 5.0.7, 5.1.9, and 5.2.5. The vulnerability arises because the application fails to properly validate ownership of address identifiers when users edit their orders. Exploitation involves altering the address IDs in the order update requests to reference addresses belonging to other users, which the server then processes as if they were the attacker's own.
Users can update to Spree versions 4.10.2, 5.0.7, 5.1.9, or 5.2.5, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| spreecommerce spree | < 4.10.2 >= 5.0.0, < 5.0.7 >= 5.1.0, < 5.1.9 >= 5.2.0, < 5.2.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 2, 2026 | Initial Analysis | [email protected] |
| Jan 8, 2026 | New CVE Received | [email protected] |