Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| spree | spree | 5.4.0 to before 5.4.4; 5.5.0 to before 5.5.4 | 5.4.4, 5.5.4 | Patch available | CNA |
| — | spree_api (RubyGems) | 5.4.0 to before 5.4.4 | 5.4.4 | Patch available | GHSA-4825-p4xm-pcf2 |
| — | spree_api (RubyGems) | 5.5.0 to before 5.5.4 | 5.5.4 | Patch available | GHSA-4825-p4xm-pcf2 |
- spree Vendorspree Affected 5.4.0 to before 5.4.4; 5.5.0 to before 5.5.4 Fixed in 5.4.4, 5.5.4 Patch available CNA
- spree_api (RubyGems) Vendor— Affected 5.4.0 to before 5.4.4 Fixed in 5.4.4 Patch available GHSA-4825-p4xm-pcf2
- spree_api (RubyGems) Vendor— Affected 5.5.0 to before 5.5.4 Fixed in 5.5.4 Patch available GHSA-4825-p4xm-pcf2
Remediation
- Fix · CNA spree (spree) Fixed in 5.4.4, 5.5.4
- Fix · GHSA-4825-p4xm-pcf2 spree_api (RubyGems) Fixed in 5.4.4 Advisory →
- Fix · GHSA-4825-p4xm-pcf2 spree_api (RubyGems) Fixed in 5.5.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-94462
- 2026-10-03 Alias added: GHSA-4825-p4xm-pcf2
References
Other 7
- https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
- https://github.com/spree/spree/pull/14314
- https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd
- https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8
- https://github.com/spree/spree/releases/tag/v5.4.4
- https://github.com/spree/spree/releases/tag/v5.5.4
- https://github.com/spree/spree
More spree vulnerabilities
- TI-2011-04629 Spreecommerce < 0.50.x API RCE CVSS 4.0CRITICAL 9.3
- TI-2026-18150 Spree API has Unauthenticated IDOR - Guest Address CVSS 3.1HIGH 7.5
- TI-2026-18149 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification CVSS 3.1MEDIUM 6.5
- TI-2011-04622 Spreecommerce < 0.60.2 Search Parameter RCE CVSS 4.0CRITICAL 10.0
- TI-2026-20825 Spree allows unauthenticated users can access all guest addresses CVSS 4.0HIGH 7.7
- TI-2021-18107 Authentication Bypass by CSRF Weakness CVSS 3.1CRITICAL 9.3
Sources
- CVE-2026-94462 · CVE Program
- CVE-2026-94462 · NVD
- FIRST EPSS
- GHSA-4825-p4xm-pcf2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences