CVE-2026-25757
1 advisory.
RubyGems/spree_storefront CVE-2026-25757: high, EPSS 0.55%
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
Action: Upgrade spree_storefront to 5.0.8 or later.
bundle update spree_storefrontAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.0.8 | - |
| 5.1.0 | 5.1.10 | - |
| 5.2.0 | 5.2.7 | - |
| 5.3.0 | 5.3.2 | - |
Fixed versions
| 5.0.8 | 5.1.10 | 5.2.7 | 5.3.2 |
Sources
- osv: GHSA-p6pv-q7rc-g4h9
- https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9
- https://nvd.nist.gov/vuln/detail/CVE-2026-25757
- https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab
- https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be
- https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d
- https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_storefront/CVE-2026-25757.yml
- https://github.com/spree/spree
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8
- https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45
CVE-2026-25757 · published · modified · JSON