Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

spree_api

4 known vulnerabilities (3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 3 high, 1 medium
Registry
RubyGems

Advisories 4

  • Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

    Affected: from 5.4.0, fixed in 5.4.4; from 5.5.0, fixed in 5.5.4.

  • Spree allows unauthenticated users can access all guest addresses

    Affected: fixed in 4.10.3; from 5.0.0, fixed in 5.0.8; from 5.1.0, fixed in 5.1.10; from 5.2.0, fixed in 5.2.7; from 5.3.0, fixed in 5.3.2.

  • CVE-2026-22588Medium 6.5

    Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

    Affected: from 3.7.0, fixed in 4.10.2; from 5.0.0, fixed in 5.0.7; from 5.1.0, fixed in 5.1.9; from 5.2.0, fixed in 5.2.5.

  • Authorization bypass in Spree

    Affected: from 3.7.0, fixed in 3.7.13; from 4.0.0, fixed in 4.0.5; from 4.1.0, fixed in 4.1.12.