CVE-2026-94462
1 advisory.
RubyGems/spree_api CVE-2026-94462: high 7.1, EPSS 0.28%
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
Action: Upgrade spree_api to 5.4.4 or later.
bundle update spree_apiAffected
| introduced | fixed | last affected |
|---|---|---|
| 5.4.0 | 5.4.4 | - |
| 5.5.0 | 5.5.4 | - |
Fixed versions
| 5.4.4 | 5.5.4 |
Sources
- osv: GHSA-4825-p4xm-pcf2
- https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
- https://github.com/spree/spree/pull/14314
- https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd
- https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8
- https://github.com/spree/spree
- https://github.com/spree/spree/releases/tag/v5.4.4
- https://github.com/spree/spree/releases/tag/v5.5.4
CVE-2026-94462 · published · modified · JSON