关键信息 漏洞类型 IDOR (Insecure Direct Object Reference) via Order Modification 漏洞影响 Package: spree_api (RubyGems) Affected Versions: <4.10.2, <5.0.7, <5.1.9, <5.2.5 Patched Versions: 4.10.2, 5.0.7, 5.1.9, 5.2.5 漏洞描述 Summary: An authenticated user can retrieve other users' address information by modifying an existing order. Affected Components: - Authenticated user order management - Address association logic - Order update endpoint(s): /api/v2/storefront/checkout 漏洞详情 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None 漏洞影响 An attacker can: - Replace the address identifier with one belonging to another user - Cause the backend to associate and return another user's address within the attacker's order CVE ID CVE-2026-22588 弱点 CWE-639