{"action":"Upgrade spree_api to 4.10.3 or later.","affected":[{"fixed":"4.10.3","introduced":"0"},{"fixed":"5.0.8","introduced":"5.0.0"},{"fixed":"5.1.10","introduced":"5.1.0"},{"fixed":"5.2.7","introduced":"5.2.0"},{"fixed":"5.3.2","introduced":"5.3.0"}],"component":"spree_api","cve_ids":["CVE-2026-25758"],"ecosystem":"RubyGems","epss":0.00671,"exploited":false,"fixed_versions":["4.10.3","5.0.8","5.1.10","5.2.7","5.3.2"],"ghsa_id":"GHSA-87fh-rc96-6fr6","id":"tcs_01M5KEHXXSYWEZTZND6M6Z26B3","modified_at":"2026-02-22T23:23:01.637912Z","published_at":"2026-02-05T21:19:30Z","references":["https://osv.dev/vulnerability/GHSA-87fh-rc96-6fr6","https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6","https://nvd.nist.gov/vuln/detail/CVE-2026-25758","https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734","https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f","https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8","https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748","https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2026-25758.yml","https://github.com/spree/spree","https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38","https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254","https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48","https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-87fh-rc96-6fr6","url":"https://osv.dev/vulnerability/GHSA-87fh-rc96-6fr6"},{"source":"nvd","source_id":"CVE-2026-25758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25758"}],"summary":"Unauthenticated Spree Commerce users can access all guest addresses"}