7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25758

CVE-2026-25758: Spree allows unauthenticated users can access all guest addresses

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25758

CVE-2026-25758:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
spree_api	rubygems	< 4.10.3	4.10.3
spree_api	rubygems	>= 5.0.0, < 5.0.8	5.0.8
spree_api	rubygems	>= 5.1.0, < 5.1.10	5.1.10
spree_api	rubygems	>= 5.2.0, < 5.2.7	5.2.7
spree_api	rubygems	>= 5.3.0, < 5.3.2	5.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in Spree Commerce's guest checkout flow, allowing unauthenticated users to access personally identifiable information (PII) of other guest users. The root cause lies in faulty authorization logic within the bill_address_id= and ship_address_id= setter methods, which are part of the Spree::Order::AddressBook module included in the Spree::Order model.

When a guest user proceeds through checkout, their order does not have an associated user_id (it is nil). If an attacker, also as a guest, manipulates the checkout update request to include the ID of an address belonging to another guest user (bill_address_id or ship_address_id), the application attempts to validate ownership. The vulnerable code checks if address.user_id == user_id. For guest users, this comparison becomes nil == nil, which evaluates to true. This flaw allows the attacker to successfully associate the victim's address with their own order, thereby exposing the victim's PII.

The patch rectifies this by introducing an additional check, user_id.present?. This ensures that the ownership validation is only attempted for authenticated users who have a non-nil user_id. For guest users, this condition fails, preventing them from assigning any existing address by its ID and mitigating the IDOR vulnerability. The identified vulnerable functions, Spree::Order.bill_address_id= and Spree::Order.ship_address_id=, are the precise locations of this flawed logic and would be observed in a runtime profile during an exploit.

Vulnerable functions

Spree::Order.bill_address_id=

core/app/models/spree/order/address_book.rb

The `bill_address_id=` setter method in the `Spree::Order::AddressBook` module does not correctly validate ownership for guest users. For guest checkouts, the `user_id` on the order is `nil`. When an attacker provides an ID of an address belonging to another guest user, its `user_id` is also `nil`. The ownership check `address.user_id == user_id` becomes `nil == nil`, which evaluates to `true`, thus bypassing the authorization check. This allows an attacker to associate an arbitrary guest address with their order.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.