Authorization bypass in Spree
Priority LOW 36CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.
Why it matters now
EPSS 0.01124 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed spree (spree): 3.7.13, 4.0.5, 4.1.12spree_api (RubyGems): 3.7.13, 4.0.5, 4.1.12
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| spree | spree | 3.7.0 to before 3.7.13; 4.0.0 to before 4.0.5; 4.1.0 to before 4.1.12 | 3.7.13, 4.0.5, 4.1.12 | Patch available | CNA |
| — | spree_api (RubyGems) | 3.7.0 to before 3.7.13 | 3.7.13 | Patch available | GHSA-m2jr-hmc3-qmpr |
| — | spree_api (RubyGems) | 4.0.0 to before 4.0.5 | 4.0.5 | Patch available | GHSA-m2jr-hmc3-qmpr |
| — | spree_api (RubyGems) | 4.1.0 to before 4.1.12 | 4.1.12 | Patch available | GHSA-m2jr-hmc3-qmpr |
- spree Vendorspree Affected 3.7.0 to before 3.7.13; 4.0.0 to before 4.0.5; 4.1.0 to before 4.1.12 Fixed in 3.7.13, 4.0.5, 4.1.12 Patch available CNA
- spree_api (RubyGems) Vendor— Affected 3.7.0 to before 3.7.13 Fixed in 3.7.13 Patch available GHSA-m2jr-hmc3-qmpr
- spree_api (RubyGems) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-m2jr-hmc3-qmpr
- spree_api (RubyGems) Vendor— Affected 4.1.0 to before 4.1.12 Fixed in 4.1.12 Patch available GHSA-m2jr-hmc3-qmpr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:* | 3.7.0 to before 3.7.13; 4.0.0 to before 4.0.5; 4.1.0 to before 4.1.12 | Vulnerable | spree |
- cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:* Versions 3.7.0 to before 3.7.13; 4.0.0 to before 4.0.5; 4.1.0 to before 4.1.12 Vulnerable ·spree
Remediation
- Fix · CNA spree (spree) Fixed in 3.7.13, 4.0.5, 4.1.12
- Fix · GHSA-m2jr-hmc3-qmpr spree_api (RubyGems) Fixed in 3.7.13 Advisory →
- Fix · GHSA-m2jr-hmc3-qmpr spree_api (RubyGems) Fixed in 4.0.5 Advisory →
- Fix · GHSA-m2jr-hmc3-qmpr spree_api (RubyGems) Fixed in 4.1.12 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26223
- 2026-10-03 Alias added: GHSA-m2jr-hmc3-qmpr
References
Advisory 3
More Spree vulnerabilities
- TI-2011-04629 Spreecommerce < 0.50.x API RCE CVSS 4.0CRITICAL 9.3
- TI-2026-18150 Spree API has Unauthenticated IDOR - Guest Address CVSS 3.1HIGH 7.5
- TI-2026-18149 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification CVSS 3.1MEDIUM 6.5
- TI-2011-04622 Spreecommerce < 0.60.2 Search Parameter RCE CVSS 4.0CRITICAL 10.0
- TI-2026-20825 Spree allows unauthenticated users can access all guest addresses CVSS 4.0HIGH 7.7
- TI-2026-20824 Unauthenticated Spree Commerce users can view completed guest orders by Order ID CVSS 4.0HIGH 7.7
Sources
- CVE-2020-26223 · CVE Program
- CVE-2020-26223 · NVD
- FIRST EPSS
- GHSA-m2jr-hmc3-qmpr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences