CVE-2026-25758
1 advisory.
RubyGems/spree_api CVE-2026-25758: high, EPSS 0.76%
Unauthenticated Spree Commerce users can access all guest addresses
Action: Upgrade spree_api to 4.10.3 or later.
bundle update spree_apiAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.10.3 | - |
| 5.0.0 | 5.0.8 | - |
| 5.1.0 | 5.1.10 | - |
| 5.2.0 | 5.2.7 | - |
| 5.3.0 | 5.3.2 | - |
Fixed versions
| 4.10.3 | 5.0.8 | 5.1.10 | 5.2.7 | 5.3.2 |
Sources
- osv: GHSA-87fh-rc96-6fr6
- https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
- https://nvd.nist.gov/vuln/detail/CVE-2026-25758
- https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734
- https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f
- https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8
- https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748
- https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2026-25758.yml
- https://github.com/spree/spree
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96
CVE-2026-25758 · published · modified · JSON