CVE-2026-22588
1 advisory.
RubyGems/spree_api CVE-2026-22588: medium 6.5
Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification
Action: Upgrade spree_api to 4.10.2 or later.
bundle update spree_apiAffected
| introduced | fixed | last affected |
|---|---|---|
| 3.7.0 | 4.10.2 | - |
| 5.0.0 | 5.0.7 | - |
| 5.1.0 | 5.1.9 | - |
| 5.2.0 | 5.2.5 | - |
Fixed versions
| 4.10.2 | 5.0.7 | 5.1.9 | 5.2.5 |
Sources
- osv: GHSA-g268-72p7-9j6j
- https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j
- https://nvd.nist.gov/vuln/detail/CVE-2026-22588
- https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72
- https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3
- https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8
- https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2026-22588.yml
- https://github.com/spree/spree
CVE-2026-22588 · published · modified · JSON