CVE-2026-22589
Description
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.074
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2026-22589 are fixed in Ruby-spree_core 4.10.2 | Windows |
| Vulnerabilities CVE-2026-22589 are fixed in Ruby-spree_core 5.0.7 | Windows |
| Vulnerabilities CVE-2026-22589 are fixed in Ruby-spree_core 5.1.9 | Windows |
| Vulnerabilities CVE-2026-22589 are fixed in Ruby-spree_core 5.2.5 | Windows |
| Vulnerabilities CVE-2026-22589 are fixed in Ruby-spree_core for Linux 4.10.2 | Linux |
| Vulnerabilities CVE-2026-22589 are fixed in Ruby-spree_core for Linux 5.0.7 | Linux |
| Vulnerabilities CVE-2026-22589 are fixed in Ruby-spree_core for Linux 5.1.9 | Linux |
| Vulnerabilities CVE-2026-22589 are fixed in Ruby-spree_core for Linux 5.2.5 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234