spree_core

Open Source Platform for DTC, B2B Commerce, Marketplaces & Omnichannel. REST APIs, TypeScript SDKs, and production-ready Next.js storefront. Self-host it. Own your data. No vendor lock-in. Zero platform fees.

View on Rubygems

View on Github

Activity

Latest release: 2d ago
Total releases: 422
Cadence: ~2 days
Last 12 months: 79

Reach

Stars: 15.8k

Details

License: BSD-3-Clause
First release: Sep 03, 2010

Releases

Version	Released
`6.0.0` major	Oct 27, 2026
`6.0.0.rc7` pre	Oct 26, 2026
`6.0.0.rc6` pre	Oct 26, 2026
`6.0.0.rc5` pre	Oct 22, 2026
`6.0.0.rc4` pre	Oct 19, 2026
`6.0.0.rc3` pre	Oct 13, 2026
`6.0.0.rc2` pre	Oct 13, 2026
`6.0.0.rc1` pre	Oct 08, 2026
`6.0.0.beta4` pre	Sep 24, 2026
`6.0.0.beta3` pre	Sep 24, 2026
`6.0.0.beta2` pre	Sep 17, 2026
`6.0.0.beta1` pre	Sep 15, 2026
`5.6.1` patch	Jul 28, 2026
`5.6.0` minor	Jul 23, 2026
`5.6.0.rc6` pre	Jul 23, 2026
`5.6.0.rc5` pre	Jul 22, 2026
`5.6.0.rc4` pre	Jul 20, 2026
`5.4.4` patch	Jul 20, 2026
`5.5.4` patch	Jul 20, 2026
`5.6.0.rc3` pre	Jul 19, 2026
`5.6.0.rc2` pre	Jul 17, 2026
`5.6.0.rc1` pre	Jul 15, 2026
`5.5.3` patch	Jul 10, 2026
`5.5.2` patch	Jul 06, 2026
`5.5.1` patch	Jun 29, 2026
`5.5.0.rc3` pre	Jun 18, 2026
`5.5.0` minor	Jun 18, 2026
`5.5.0.rc2` pre	Jun 15, 2026
`5.5.0.rc1` pre	Jun 10, 2026
`5.3.6` patch	May 19, 2026
`5.2.8` patch	May 19, 2026
`5.4.3` patch	May 19, 2026
`5.4.2` patch	Apr 27, 2026
`5.4.1` patch	Apr 14, 2026
`5.4.0.rc8` pre	Apr 08, 2026
`5.4.0` minor	Apr 08, 2026
`5.4.0.rc7` pre	Apr 08, 2026
`5.4.0.rc6` pre	Apr 04, 2026
`5.4.0.rc5` pre	Mar 30, 2026
`5.4.0.rc4.1` pre	Mar 30, 2026
`5.4.0.rc4` pre	Mar 26, 2026
`5.4.0.rc3` pre	Mar 25, 2026
`5.4.0.rc2` pre	Mar 23, 2026
`5.4.0.rc1` pre	Mar 20, 2026
`5.4.0.beta10` pre	Mar 19, 2026
`5.4.0.beta9` pre	Mar 17, 2026
`5.4.0.beta8` pre	Mar 16, 2026
`5.4.0.beta7` pre	Mar 15, 2026
`5.3.5` patch	Mar 12, 2026
`5.4.0.beta6` pre	Mar 11, 2026

1–50 of 422

Repository

spree/spree

Forks: 5.3k
Open issues: 90
Language: Ruby
: 5.5/ 10

ecommerce
e-commerce
ecommerce-platform
spree-commerce
marketplace
multi-tenant

Dependencies (47)

Depends on

6.0.0

Used by

429

Supply-chain exposure

429 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-22589 GHSA-3ghg-3787-w2xr Jan 08, 2026

Spree API has Unauthenticated IDOR - Guest Address

7.5 / 10
High
Network Low None None Unchanged High None None

Summary

An Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies.

Details

During testing, it was observed that all guest users can make an unauthenticated request to retrieve address data belonging to other guest users by manipulating object identifiers. The attacker would need to know the storefront URL structure to perform this attack (which can be learnt after creating a registered user account).

Affected Component(s)

Address Edit endpoint: /addresses/{addressId}/edit

Root Cause

Faulty authorization check in CanCanCan Ability class:

- can :manage, ::Spree::Address, user_id: user.id + can :manage, ::Spree::Address, user_id: user.id if user.persisted?

the user object in Spree::Ability class for guest users is a Spree.user_class.new object.

Addresses endpoint to access it is part of the spree_storefront gem. Headless builds using APIs are not affected, as the Addresses endpoint there is only for registered users, and records are scoped to the currently signed-in user.

PoC

Preconditions

No authentication required

No cookies or session tokens set

To reproduce this vulnerability simply perform the request shown below, replacing the number with an arbitrary value.

For the initial request the Guest Address id = 6 is used to obtain the information

Request GET /addresses/6/edit

Repeat the request and check the response, in this example using Guest Address id = 2.

Request GET /addresses/2/edit

Impact

An unauthenticated attacker can:

Enumerate and retrieve guest address information (Addresses associated with User accounts are NOT affected)

Access personally identifiable information (PII) such as:

Full names

Physical addresses

Phone numbers (if present)

This vulnerability could lead to:

Privacy violations

Regulatory compliance issues (e.g., GDPR)

Loss of user trust

Affected versions

4.0.04.0.14.0.24.0.34.0.44.0.54.0.64.0.74.0.7.14.0.84.0.94.1.0

+ 90 more Show less

4.1.0.rc14.1.0.rc24.1.0.rc34.1.14.1.104.1.114.1.124.1.134.1.13.14.1.144.1.154.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.10.04.10.14.2.04.2.0.beta4.2.0.rc14.2.0.rc24.2.0.rc34.2.0.rc44.2.0.rc54.2.14.2.24.2.34.2.3.14.2.44.2.54.2.64.2.74.3.04.3.0.rc14.3.0.rc24.3.0.rc34.3.14.3.24.3.34.4.04.4.0.rc14.4.0.rc24.4.14.5.04.5.14.5.24.5.34.5.44.5.54.6.04.6.14.6.24.6.34.6.44.6.54.6.64.7.04.7.14.7.24.7.34.8.04.8.14.8.24.8.34.9.05.0.05.0.15.0.25.0.35.0.45.0.55.0.65.1.05.1.15.1.25.1.35.1.45.1.55.1.65.1.75.1.85.2.05.2.15.2.25.2.35.2.4

Fixed in

4.10.25.0.75.1.95.2.5

References

https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr
https://nvd.nist.gov/vuln/detail/CVE-2026-22589
https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795
https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad
https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67
https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad

Updated Feb 03, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 6
minor 34
patch 272
pre 109

422 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More