Spree vulnerabilities
We track 3 vulnerabilities in Spree products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest Spree vulnerabilities
- 7.1 High severity
spree: Authorization Bypass Through User-Controlled Key
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id b
- 7.5 High severity
spree: Authorization Bypass Through User-Controlled Key
Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters
- 7.5 High severity
spree: Authorization Bypass Through User-Controlled Key
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access g