{"action":"Upgrade spree_core to 4.10.2 or later.","affected":[{"fixed":"4.10.2","introduced":"4.0.0"},{"fixed":"5.0.7","introduced":"5.0.0"},{"fixed":"5.1.9","introduced":"5.1.0"},{"fixed":"5.2.5","introduced":"5.2.0"}],"component":"spree_core","cve_ids":["CVE-2026-22589"],"ecosystem":"RubyGems","epss":0.00446,"exploited":false,"fixed_versions":["4.10.2","5.0.7","5.1.9","5.2.5"],"ghsa_id":"GHSA-3ghg-3787-w2xr","id":"tcs_01M5KEG9KT792829X87JWEJGC5","modified_at":"2026-02-03T03:03:25.828963Z","published_at":"2026-01-08T21:28:04Z","references":["https://osv.dev/vulnerability/GHSA-3ghg-3787-w2xr","https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr","https://nvd.nist.gov/vuln/detail/CVE-2026-22589","https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795","https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad","https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67","https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml","https://github.com/spree/spree"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-3ghg-3787-w2xr","url":"https://osv.dev/vulnerability/GHSA-3ghg-3787-w2xr"}],"summary":"Spree API has Unauthenticated IDOR - Guest Address"}