CVE-2026-25757
📋 TL;DR
Unauthenticated users can view completed guest orders by Order ID in Spree e-commerce platform, potentially exposing guest user PII including names, addresses, and phone numbers. This affects all Spree deployments running vulnerable versions. The vulnerability stems from insufficient access controls on guest order endpoints.
💻 Affected Systems
- Spree e-commerce platform
📦 What is this software?
Spree by Spreecommerce
Spree by Spreecommerce
Spree by Spreecommerce
Spree by Spreecommerce
⚠️ Risk & Real-World Impact
Worst Case
Mass scraping of guest order data leading to large-scale PII exposure, identity theft, and regulatory compliance violations.
Likely Case
Targeted information gathering about specific customers, potentially enabling social engineering or phishing attacks.
If Mitigated
Limited exposure if proper network segmentation and monitoring are in place, but PII disclosure risk remains.
🎯 Exploit Status
Exploitation requires only knowledge of order IDs, which may be predictable or enumerable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.8, 5.1.10, 5.2.7, or 5.3.2 depending on your version line
Vendor Advisory: https://github.com/spree/spree/security/advisories
Restart Required: Yes
Instructions:
1. Identify your Spree version. 2. Update to the corresponding patched version: 5.0.x → 5.0.8, 5.1.x → 5.1.10, 5.2.x → 5.2.7, 5.3.x → 5.3.2. 3. Restart the application server. 4. Verify the fix.
🔧 Temporary Workarounds
Implement custom authentication middleware
allAdd authentication checks to guest order endpoints before patching
# Add to orders_controller.rb or middleware
before_action :authenticate_user, only: [:show]
🧯 If You Can't Patch
- Implement WAF rules to block unauthenticated access to /orders/* endpoints
- Disable guest checkout functionality temporarily
🔍 How to Verify
Check if Vulnerable:
Attempt to access /orders/{order_id} endpoint without authentication using a known guest order IDCheck Version:
bundle show spree | grep -o 'spree-[0-9.]*'Verify Fix Applied:
Verify the same unauthenticated request now returns 401/403 or redirects to login📡 Detection & Monitoring
Log Indicators:
- Unauthenticated GET requests to /orders/* endpoints returning 200 status
Network Indicators:
- Unusual volume of requests to order endpoints from unauthenticated sources
SIEM Query:
source="spree.log" AND (uri_path="/orders/*" OR uri_path LIKE "/orders/%") AND http_status=200 AND user_id=null🔗 References
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8
- https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45
- https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab
- https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be
- https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d
- https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad
- https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9
