{"action":"Upgrade spree_api to 5.4.4 or later.","affected":[{"fixed":"5.4.4","introduced":"5.4.0"},{"fixed":"5.5.4","introduced":"5.5.0"}],"component":"spree_api","cve_ids":["CVE-2026-94462"],"ecosystem":"RubyGems","epss":0.00384,"exploited":false,"fixed_versions":["5.4.4","5.5.4"],"ghsa_id":"GHSA-4825-p4xm-pcf2","id":"tcs_01M5KEGHBE0JNYQPEH0GBG9HGN","modified_at":"2026-09-22T21:00:05.238442332Z","published_at":"2026-09-22T20:40:30Z","references":["https://osv.dev/vulnerability/GHSA-4825-p4xm-pcf2","https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2","https://github.com/spree/spree/pull/14314","https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd","https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8","https://github.com/spree/spree","https://github.com/spree/spree/releases/tag/v5.4.4","https://github.com/spree/spree/releases/tag/v5.5.4"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-4825-p4xm-pcf2","url":"https://osv.dev/vulnerability/GHSA-4825-p4xm-pcf2"}],"summary":"Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)"}