spree_api

Open Source Platform for DTC, B2B Commerce, Marketplaces & Omnichannel. REST APIs, TypeScript SDKs, and production-ready Next.js storefront. Self-host it. Own your data. No vendor lock-in. Zero platform fees.

View on Rubygems

View on Github

Activity

Latest release: 2d ago
Total releases: 422
Cadence: ~2 days
Last 12 months: 79

Reach

Stars: 15.8k

Details

License: BSD-3-Clause
First release: Sep 03, 2010

Releases

Version	Released
`6.0.0` major	Oct 27, 2026
`6.0.0.rc7` pre	Oct 26, 2026
`6.0.0.rc6` pre	Oct 26, 2026
`6.0.0.rc5` pre	Oct 22, 2026
`6.0.0.rc4` pre	Oct 19, 2026
`6.0.0.rc3` pre	Oct 13, 2026
`6.0.0.rc2` pre	Oct 13, 2026
`6.0.0.rc1` pre	Oct 08, 2026
`6.0.0.beta4` pre	Sep 24, 2026
`6.0.0.beta3` pre	Sep 24, 2026
`6.0.0.beta2` pre	Sep 17, 2026
`6.0.0.beta1` pre	Sep 15, 2026
`5.6.1` patch	Jul 28, 2026
`5.6.0.rc6` pre	Jul 23, 2026
`5.6.0` minor	Jul 23, 2026
`5.6.0.rc5` pre	Jul 22, 2026
`5.5.4` patch	Jul 20, 2026
`5.4.4` patch	Jul 20, 2026
`5.6.0.rc4` pre	Jul 20, 2026
`5.6.0.rc3` pre	Jul 19, 2026
`5.6.0.rc2` pre	Jul 17, 2026
`5.6.0.rc1` pre	Jul 15, 2026
`5.5.3` patch 1 CVE	Jul 10, 2026
`5.5.2` patch 1 CVE	Jul 06, 2026
`5.5.1` patch 1 CVE	Jun 29, 2026
`5.5.0.rc3` pre	Jun 18, 2026
`5.5.0` minor 1 CVE	Jun 18, 2026
`5.5.0.rc2` pre	Jun 15, 2026
`5.5.0.rc1` pre	Jun 10, 2026
`5.3.6` patch	May 19, 2026
`5.2.8` patch	May 19, 2026
`5.4.3` patch 1 CVE	May 19, 2026
`5.4.2` patch 1 CVE	Apr 27, 2026
`5.4.1` patch 1 CVE	Apr 14, 2026
`5.4.0.rc8` pre	Apr 08, 2026
`5.4.0` minor 1 CVE	Apr 08, 2026
`5.4.0.rc7` pre	Apr 08, 2026
`5.4.0.rc6` pre	Apr 04, 2026
`5.4.0.rc5` pre	Mar 30, 2026
`5.4.0.rc4.1` pre	Mar 30, 2026
`5.4.0.rc4` pre	Mar 26, 2026
`5.4.0.rc3` pre	Mar 25, 2026
`5.4.0.rc2` pre	Mar 23, 2026
`5.4.0.rc1` pre	Mar 20, 2026
`5.4.0.beta10` pre	Mar 19, 2026
`5.4.0.beta9` pre	Mar 17, 2026
`5.4.0.beta8` pre	Mar 16, 2026
`5.4.0.beta7` pre	Mar 15, 2026
`5.3.5` patch	Mar 12, 2026
`5.4.0.beta6` pre	Mar 11, 2026

1–50 of 422

Repository

spree/spree

Forks: 5.3k
Open issues: 90
Language: Ruby
: 5.5/ 10

ecommerce
e-commerce
ecommerce-platform
spree-commerce
marketplace
multi-tenant

Dependencies (3)

Depends on

6.0.0

Used by

Supply-chain exposure

26 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (4)

CVE-2026-94462 GHSA-4825-p4xm-pcf2 Sep 22, 2026

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

7.1 / 10
High
Network Low Low None Unchanged High Low None

Summary

The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id]) — and omits the authorize!(:update, @cart, cart_token) check that every other action in the controller performs via CartResolvable. Because prefixed IDs are a reversible Sqids encoding of the auto-increment primary key (obfuscation, not a token), an authenticated customer can name arbitrary guest cart IDs, take them over, and read the checkout addresses stored on them. This is broken access control / IDOR, reachable by any low-privilege registered user.

Severity

Requires an authenticated store account and depends on target guest carts already carrying an address and not yet being associated, on a store not running in login_required mode. Confidentiality impact is the driver (guest checkout PII); integrity impact is limited and recoverable (cart reassignment + email overwrite on an in-progress cart). Not Critical: the action is gated behind authentication (PR:L, not PR:N) and constrained by cart state, so it is not anonymously exploitable.

Details

Root cause: associate skips the cart-possession check its sibling actions enforce and trusts a guessable identifier as the sole locator.

Entry point. Spree::Api::V3::Store::CartsController#associate (carts_controller.rb:88-96), guarded only by prepend_before_action :require_authentication!, only: [:index, :associate]. That requires the caller be authenticated; it does not tie the request to a specific guest cart.

# spree/api/app/controllers/spree/api/v3/store/carts_controller.rb:88-96 # PATCH /api/v3/store/carts/:id/associate def associate @cart = find_cart_for_association result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true) if result.success? render_cart else render_service_error(result.error.to_s) end end

Missing check. find_cart_for_association (carts_controller.rb:177-178) resolves any guest cart (user IS NULL) in the store by ID with no authorize!(..., cart_token). Contrast CartResolvable#find_cart!, which binds the token.

# spree/api/app/controllers/spree/api/v3/store/carts_controller.rb:177-178 def find_cart_for_association current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id]) end

Identifier. prefixed_id is "cart_" + SQIDS.encode([id]) with SQIDS = Sqids.new(min_length: 10) (prefixed_id.rb:17,56) — default alphabet, no salt, no blocklist. Sqids is non-cryptographic and reversible, so candidate IDs are derivable offline from sequential primary keys.

# spree/core/app/models/concerns/spree/prefixed_id.rb:17-56 SQIDS = Sqids.new(min_length: 10) def prefixed_id return nil unless id.present? "#{self.class._prefix_id_prefix}_#{Spree::PrefixedId::SQIDS.encode([id])}" end

Data flow. Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true) reassigns the owner and overwrites email, preserving existing addresses via bill_address ||= / ship_address ||=. render_cart then serializes billing_address/shipping_address (first_name, last_name, address1, address2, city, postal_code, phone, company) back to the caller.

PoC

Preconditions: attacker holds an ordinary store account (self-service registration) and the store's publishable key (a front-end credential, present in any headless storefront bundle); one or more guest carts carry checkout addresses; store is not in login_required mode.

Authenticate: POST /api/v3/store/auth/login → attacker JWT.

Derive candidate IDs offline: "cart_" + Sqids.encode([n]) for a range of n.

For each candidate: PATCH /api/v3/store/carts/<id>/associate with the attacker JWT. A hit returns 200 with the victim's billing_address/shipping_address; non-guest or missing carts return 404/422.

Impact

Confidentiality: an authenticated attacker can enumerate guest cart IDs and read checkout PII (name, street, postal code, phone) on carts they don't own. Integrity: limited and recoverable — each call reassigns the guest cart and overwrites its email, disrupting the original guest's in-progress cart. Requires a registered account, so not anonymously exploitable.

Remediation

Update to Spree 5.4.4 or 5.5.4. Your storefront, based on https://github.com/spree/storefront, doesn't need any updates because it has always sent a cart token when associating carts; this is a backend issue.

Affected versions

5.4.05.4.15.4.25.4.35.5.05.5.15.5.25.5.3

Fixed in

5.4.45.5.4

References

https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
https://github.com/spree/spree/pull/14314
https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd
https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8
https://github.com/spree/spree
https://github.com/spree/spree/releases/tag/v5.4.4

Updated Sep 22, 2026 · Source: OSV.dev
CVE-2026-25758 GHSA-87fh-rc96-6fr6 Feb 05, 2026

Unauthenticated Spree Commerce users can access all guest addresses

High
Network Low None None

Summary

A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

Unauthenticated users can access all guest addresses (GHSL-2026-027)

The vulnerability stems from incomplete authorization validation in Spree's checkout address assignment logic. While nested address attributes (bill_address_attributes[id] and ship_address_attributes[id]) are properly validated through validate_address_ownership, plain ID parameters (bill_address_id and ship_address_id) bypass this check entirely. Since Spree's address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.

Affected Code Components

Permitted Attributes (core/lib/spree/permitted_attributes.rb:92–96)

Allows bill_address_id and ship_address_id as permitted parameters without validation

Checkout Update (core/app/models/spree/order/checkout.rb:241–254)

Applies permitted parameters directly to the Order model via update_from_params

Incomplete Ownership Validation (core/app/services/spree/checkout/update.rb:33–48)

validate_address_ownership only validates nested attributes structure

Does NOT validate plain bill_address_id/ship_address_id fields

Vulnerable Assignment Logic (core/app/models/spree/order/address_book.rb:16–23, 31–38)

bill_address_id= setter

ship_address_id= setter

Both setters check that: address.user_id == order.user_id. For guest orders: nil == nil → TRUE ✓ (bypass!)

Proof of Concept

Precondition: One guest address has to exist in Spree's database. (E.g. Create an order with a guest account and note the ID from the spree_addresses table. E.g. 3)

As a guest user:

Put one product in the cart and go to checkout.

Fill in some address/phone number and continue.

Modify this script containing a curl request with current values.

#!/bin/bash ATTACKER_ORDER_TOKEN="" # Taken from the URL VICTIM_ADDRESS_ID="3" # As noted from the database CSRF_TOKEN="" # From page source; `content` value from meta param `csrf-token`. SESSION_COOKIE="token=...; _my_store_session=..." # from the browsers cookie store. curl -i -X POST \ -H "x-csrf-token: ${CSRF_TOKEN}" \ -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" \ -b "${SESSION_COOKIE}" \ --data-urlencode "_method=patch" \ --data-urlencode "authenticity_token=${CSRF_TOKEN}" \ --data-urlencode "order[ship_address_id]=${VICTIM_ADDRESS_ID}" \ "http://localhost:3000/checkout/${ATTACKER_ORDER_TOKEN}/update/address"

Expected Result: Attacker's order now references victim's address. Through that the attacker has all address details in full display. This can be verified by accessing /checkout/${ATTACKER_ORDER_TOKEN}/delivery in the same browser where you created the new guest cart.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-284: Improper Access Control

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions

0.30.00.30.0.beta10.30.10.30.20.40.00.40.10.40.20.40.30.40.40.50.00.50.10.50.2

+ 337 more Show less

0.50.30.50.40.60.00.60.0.RC10.60.10.60.20.60.30.60.40.60.50.60.60.70.00.70.0.rc20.70.10.70.20.70.30.70.40.70.50.70.60.70.70.70.RC11.0.01.0.0.rc11.0.0.rc21.0.0.rc31.0.0.rc41.0.11.0.21.0.31.0.41.0.61.0.71.1.01.1.0.rc11.1.0.rc21.1.11.1.21.1.2.rc11.1.31.1.41.1.51.1.61.2.01.2.0.rc11.2.0.rc21.2.21.2.31.2.41.2.51.3.01.3.0.rc11.3.0.rc21.3.11.3.21.3.31.3.41.3.52.0.02.0.0.rc12.0.12.0.102.0.112.0.122.0.132.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.102.1.112.1.122.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.122.3.132.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0.rc12.4.0.rc22.4.0.rc32.4.12.4.102.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.0.rc13.0.0.rc33.0.0.rc43.0.13.0.103.0.23.0.33.0.43.0.53.0.63.0.6.13.0.73.0.83.0.93.1.03.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.13.1.103.1.113.1.123.1.133.1.143.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.0.rc13.2.0.rc23.2.0.rc33.2.13.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.0.rc13.3.0.rc23.3.0.rc33.3.0.rc43.3.13.3.23.3.33.3.43.3.53.3.63.4.03.4.0.rc13.4.0.rc23.4.13.4.23.4.33.4.43.4.53.4.63.5.03.5.0.rc13.5.0.rc23.6.03.6.0.rc13.6.13.6.23.6.33.6.43.6.53.6.63.7.03.7.0.rc13.7.0.rc23.7.0.rc33.7.13.7.103.7.113.7.123.7.133.7.143.7.14.13.7.23.7.33.7.43.7.53.7.63.7.73.7.83.7.94.0.04.0.0.beta4.0.0.rc14.0.0.rc24.0.0.rc34.0.14.0.24.0.34.0.44.0.54.0.64.0.74.0.7.14.0.84.0.94.1.04.1.0.rc14.1.0.rc24.1.0.rc34.1.14.1.104.1.114.1.124.1.134.1.13.14.1.144.1.154.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.10.04.10.14.10.24.2.04.2.0.beta4.2.0.rc14.2.0.rc24.2.0.rc34.2.0.rc44.2.0.rc54.2.14.2.24.2.34.2.3.14.2.44.2.54.2.64.2.74.3.04.3.0.rc14.3.0.rc24.3.0.rc34.3.14.3.24.3.34.4.04.4.0.rc14.4.0.rc24.4.14.5.04.5.14.5.24.5.34.5.44.5.54.6.04.6.14.6.24.6.34.6.44.6.54.6.64.7.04.7.14.7.24.7.34.8.04.8.14.8.24.8.34.9.05.0.05.0.15.0.25.0.35.0.45.0.55.0.65.0.75.1.05.1.15.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.15.2.25.2.35.2.45.2.55.2.65.3.05.3.1

Fixed in

4.10.35.0.85.1.105.2.75.3.2

References

https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
https://nvd.nist.gov/vuln/detail/CVE-2026-25758
https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734
https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f
https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8
https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748

Updated Feb 22, 2026 · Source: OSV.dev
CVE-2026-22588 GHSA-g268-72p7-9j6j Jan 08, 2026

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

6.5 / 10
Medium
Network Low Low None Unchanged High None None

Summary

An Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker’s order and returning them in the response.

Details

Affected Component(s)

Authenticated user order management

Address association logic

Order update endpoint(s) Affected Endpoint(s):

/api/v2/storefront/checkout

The application fails to enforce proper object-level authorization when updating an existing order. While the user is authenticated and authorized to modify their own order, the backend does not verify that the supplied address identifiers belong to the same authenticated user.

PoC

Preconditions

Valid authenticated user account

Step 1: Log-in using a valid user, in this case customer2@example.com Step 2: Visualize current user’s addresses

Request GET /account/addresses

The following screenshot shows customer2@example.com address.

Step 3: Initialize the Shopping Cart

Request POST /api/v2/storefront/cart HTTP/1.1

From the response, extract the token marked in bold.

Step 4: Legitimate Order Edit Request

Using the obtained order token A1cram_6cFWpoj4V1yPkuQ1767113871701 perform an edit order request in order to add a custom billing address

Request PATCH /api/v2/storefront/checkout

{ "include": "billing_address", "order": { "email": "idor_test@example.com", "bill_address_attributes": { "firstname":"CTF","lastname":"Tester","address1":"123 Main St", "city":"Andorra la Vella","zipcode":"AD100","country_iso":"AD" }, "ship_address_attributes": { "firstname":"CTF","lastname":"Tester","address1":"123 Main St", "city":"Andorra la Vella","zipcode":"AD100","country_iso":"AD" } } }

Step 5: Modify the order request to include the other user's address and trigger the IDOR.

In this request, the attacker modifies the request by substituting the address identifier with one belonging to another user, thereby rendering the original address identifier accessible to the attacker.

Request PATCH /api/v2/storefront/checkout

{"include":"billing_address","order":**{"bill_address_attributes":{"id":1}}**}

As can be seen other user's address is displayed.

Impact

As a result, an attacker can:

Replace the address identifier with one belonging to another user

Cause the backend to associate and return another user’s address within the attacker’s order

Affected versions

3.7.03.7.13.7.103.7.113.7.123.7.133.7.143.7.14.13.7.23.7.33.7.43.7.5

+ 110 more Show less

3.7.63.7.73.7.83.7.94.0.04.0.0.beta4.0.0.rc14.0.0.rc24.0.0.rc34.0.14.0.24.0.34.0.44.0.54.0.64.0.74.0.7.14.0.84.0.94.1.04.1.0.rc14.1.0.rc24.1.0.rc34.1.14.1.104.1.114.1.124.1.134.1.13.14.1.144.1.154.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.10.04.10.14.2.04.2.0.beta4.2.0.rc14.2.0.rc24.2.0.rc34.2.0.rc44.2.0.rc54.2.14.2.24.2.34.2.3.14.2.44.2.54.2.64.2.74.3.04.3.0.rc14.3.0.rc24.3.0.rc34.3.14.3.24.3.34.4.04.4.0.rc14.4.0.rc24.4.14.5.04.5.14.5.24.5.34.5.44.5.54.6.04.6.14.6.24.6.34.6.44.6.54.6.64.7.04.7.14.7.24.7.34.8.04.8.14.8.24.8.34.9.05.0.05.0.15.0.25.0.35.0.45.0.55.0.65.1.05.1.15.1.25.1.35.1.45.1.55.1.65.1.75.1.85.2.05.2.15.2.25.2.35.2.4

Fixed in

4.10.25.0.75.1.95.2.5

References

https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j
https://nvd.nist.gov/vuln/detail/CVE-2026-22588
https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72
https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3
https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8
https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7

Updated Feb 03, 2026 · Source: OSV.dev
CVE-2020-26223 GHSA-m2jr-hmc3-qmpr Nov 13, 2020

Authorization bypass in Spree

7.7 / 10
High
Network Low Low None Changed High None None

Impact

The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token

Patches

Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

References

Pull request with a fix and in-depth explanation - https://github.com/spree/spree/pull/10573

For more information

If you have any questions or comments about this advisory:

Email us at security@spreecommerce.org

Affected versions

3.7.03.7.13.7.103.7.113.7.123.7.23.7.33.7.43.7.53.7.63.7.73.7.8

+ 18 more Show less

3.7.94.0.04.0.14.0.24.0.34.0.44.1.04.1.14.1.104.1.114.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.9

Fixed in

3.7.134.0.54.1.12

References

https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr
https://nvd.nist.gov/vuln/detail/CVE-2020-26223
https://github.com/spree/spree/pull/10573
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2020-26223.yml
https://github.com/spree/spree
https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 6
minor 34
patch 272
pre 109

422 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More