CVE-2026-22589
1 advisory.
RubyGems/spree_core CVE-2026-22589: high 7.5, EPSS 0.45%
Spree API has Unauthenticated IDOR - Guest Address
Action: Upgrade spree_core to 4.10.2 or later.
bundle update spree_coreAffected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.10.2 | - |
| 5.0.0 | 5.0.7 | - |
| 5.1.0 | 5.1.9 | - |
| 5.2.0 | 5.2.5 | - |
Fixed versions
| 4.10.2 | 5.0.7 | 5.1.9 | 5.2.5 |
Sources
- osv: GHSA-3ghg-3787-w2xr
- https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr
- https://nvd.nist.gov/vuln/detail/CVE-2026-22589
- https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795
- https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad
- https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67
- https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml
- https://github.com/spree/spree
CVE-2026-22589 · published · modified · JSON