N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-87fh-rc96-6fr6

GHSA-87fh-rc96-6fr6: Unauthenticated Spree Commerce users can access all guest addresses

Summary

A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

Unauthenticated users can access all guest addresses (`GHSL-2026-027`)

The vulnerability stems from incomplete authorization validation in Spree's checkout address assignment logic. While nested address attributes (bill_address_attributes[id] and ship_address_attributes[id]) are properly validated through validate_address_ownership, plain ID parameters (bill_address_id and ship_address_id) bypass this check entirely. Since Spree's address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.

Affected Code Components

Permitted Attributes (core/lib/spree/permitted_attributes.rb:92–96)
- Allows bill_address_id and ship_address_id as permitted parameters without validation
Checkout Update (core/app/models/spree/order/checkout.rb:241–254)
- Applies permitted parameters directly to the Order model via update_from_params
Incomplete Ownership Validation ()

Miggo Vulnerability Database

→

GHSA-87fh-rc96-6fr6

GHSA-87fh-rc96-6fr6:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
spree_api	rubygems	< 4.10.3	4.10.3
spree_api	rubygems	>= 5.0.0, < 5.0.8	5.0.8
spree_api	rubygems	>= 5.1.0, < 5.1.10	5.1.10
spree_api	rubygems	>= 5.2.0, < 5.2.7	5.2.7
spree_api	rubygems	>= 5.3.0, < 5.3.2	5.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in Spree Commerce's guest checkout process. It allows an unauthenticated guest user to access and associate any other guest user's shipping or billing address with their own order. The root cause lies in the bill_address_id= and ship_address_id= methods within the Spree::Order::AddressBook module. These methods were intended to verify that an address belongs to the user associated with the order. However, the check address.user_id == user_id fails for guest checkouts where the user_id is nil. In this scenario, if an attacker provides the ID of an address belonging to another guest user (which also has a nil user_id), the check becomes nil == nil, which evaluates to true, thus bypassing the ownership validation. An attacker can enumerate sequential address IDs to steal the Personally Identifiable Information (PII) of other guest users. The patch mitigates this by adding a user_id.present? check, ensuring that the ownership validation is only performed for authenticated users, and preventing guest users from assigning existing addresses by ID.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-87fh-rc96-6fr6: Unauthenticated Spree Commerce users can access all guest addresses

Summary

Impact

Unauthenticated users can access all guest addresses (GHSL-2026-027)

Affected Code Components

GHSA-87fh-rc96-6fr6:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

GHSA-87fh-rc96-6fr6: Unauthenticated Spree Commerce users can access all guest addresses

Summary

Impact

Unauthenticated users can access all guest addresses (GHSL-2026-027)

Affected Code Components

Proof of Concept

Impact

CWEs

Credit

Disclosure Policy

Unauthenticated users can access all guest addresses (`GHSL-2026-027`)

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Unauthenticated users can access all guest addresses (`GHSL-2026-027`)