CVE-2026-22589— Spree API has Unauthenticated IDOR - Guest Address
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-22589
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spree API has Unauthenticated IDOR - Guest Address
Source: NVD (National Vulnerability Database)
Vulnerability Description
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
Spree Commerce 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spree Commerce是Spree开源的一个电子商务平台。 Spree Commerce 4.10.2之前版本、5.0.7之前版本、5.1.9之前版本和5.2.5之前版本存在安全漏洞，该漏洞源于未经身份验证的不安全直接对象引用，可能导致未经身份验证的攻击者无需提供有效凭据或会话cookie即可访问访客地址信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-22589
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22589
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: spree
- CVE-2026-25757
Unauthenticated Spree Commerce users can view completed gues - CVE-2026-25758
Spree allows unauthenticated users can access all guest addr - CVE-2026-22588
Spree API has Authenticated Insecure Direct Object Reference - CVE-2020-26223
Authorization bypass in Spree - CVE-2020-15269
Expired token reuse in Spree
Same vendor: spree
- CVE-2026-25757
Unauthenticated Spree Commerce users can view completed gues - CVE-2026-25758
Spree allows unauthenticated users can access all guest addr - CVE-2026-22588
Spree API has Authenticated Insecure Direct Object Reference - CVE-2021-41275
Authentication Bypass by CSRF Weakness - CVE-2020-26223
Authorization bypass in Spree
Same weakness: CWE-639
- CVE-2026-8196
JeecgBoot mLogin Endpoint LoginController.java authorization - CVE-2026-42291
SysReptor: Read-write access to personal notes by sharing-li - CVE-2026-44400
MailEnable Enterprise Premium < 10.55 Authorization Bypass v - CVE-2026-42279
solidtime: Time entry update endpoint allows cross-organizat - CVE-2026-42277
Onyx: IDOR in /chat/file/{file_id} allows any authenticated
V. Comments for CVE-2026-22589
No comments yet