spree_storefront

Version	Released
`5.4.6` patch	Jul 28, 2026
`5.4.5` patch	Jun 29, 2026
`5.3.6` patch	May 19, 2026
`5.2.8` patch	May 19, 2026
`5.4.3` patch	Apr 28, 2026
`5.4.1` patch	Apr 11, 2026
`5.4.0` minor	Apr 08, 2026
`5.3.5` patch	Mar 12, 2026
`5.3.4` patch	Feb 23, 2026
`5.3.3` patch	Feb 16, 2026
`5.2.7` patch	Feb 05, 2026
`5.3.2` patch	Feb 05, 2026
`5.1.10` patch	Feb 05, 2026
`5.0.8` patch	Feb 05, 2026
`5.3.1` patch 1 CVE	Feb 02, 2026
`5.3.0` minor 1 CVE	Jan 26, 2026
`5.3.0.rc2` pre	Jan 22, 2026
`5.3.0.rc1` pre	Jan 22, 2026
`5.2.6` patch 1 CVE	Jan 15, 2026
`5.2.5` patch 1 CVE	Jan 08, 2026
`5.1.9` patch 1 CVE	Jan 08, 2026
`5.0.7` patch 1 CVE	Jan 08, 2026
`5.2.4` patch 1 CVE	Dec 18, 2025
`5.2.3` patch 1 CVE	Dec 16, 2025
`5.2.2` patch 1 CVE	Dec 09, 2025
`5.2.1` patch 1 CVE	Dec 02, 2025
`5.2.0` minor 1 CVE	Nov 27, 2025
`5.2.0.rc3` pre	Nov 18, 2025
`5.2.0.rc2` pre	Nov 09, 2025
`5.2.0.rc1` pre	Nov 04, 2025
`5.1.8` patch 1 CVE	Oct 30, 2025
`5.1.7` patch 1 CVE	Sep 29, 2025
`5.1.6` patch 1 CVE	Sep 18, 2025
`5.1.5` patch 1 CVE	Aug 06, 2025
`5.0.6` patch 1 CVE	Aug 06, 2025
`5.1.4` patch 1 CVE	Jul 24, 2025
`5.1.3` patch 1 CVE	Jul 20, 2025
`5.1.2` patch 1 CVE	Jul 14, 2025
`5.1.1` patch 1 CVE	Jul 08, 2025
`5.1.0` minor 1 CVE	Jul 03, 2025
`5.1.0.rc1` pre	Jul 02, 2025
`5.0.5` patch 1 CVE	Jun 30, 2025
`5.1.0.beta4` pre	Jun 04, 2025
`5.1.0.beta3` pre	May 29, 2025
`5.0.4` patch 1 CVE	May 22, 2025
`5.1.0.beta2` pre	May 22, 2025
`5.1.0.beta` pre	May 20, 2025
`5.0.3` patch 1 CVE	May 06, 2025
`5.0.2` patch 1 CVE	Apr 22, 2025
`5.0.1` patch 1 CVE	Apr 09, 2025

5.4.6 patch

Jul 28, 2026

5.4.5 patch

Jun 29, 2026

5.3.6 patch

May 19, 2026

5.2.8 patch

May 19, 2026

5.4.3 patch

Apr 28, 2026

5.4.1 patch

Apr 11, 2026

5.4.0 minor

Apr 08, 2026

5.3.5 patch

Mar 12, 2026

5.3.4 patch

Feb 23, 2026

5.3.3 patch

Feb 16, 2026

5.2.7 patch

Feb 05, 2026

5.3.2 patch

Feb 05, 2026

5.1.10 patch

Feb 05, 2026

5.0.8 patch

Feb 05, 2026

5.3.1 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Feb 02, 2026

5.3.0 minor

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jan 26, 2026

5.3.0.rc2 pre

Jan 22, 2026

5.3.0.rc1 pre

Jan 22, 2026

5.2.6 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jan 15, 2026

5.2.5 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jan 08, 2026

5.1.9 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jan 08, 2026

5.0.7 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jan 08, 2026

5.2.4 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Dec 18, 2025

5.2.3 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Dec 16, 2025

5.2.2 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Dec 09, 2025

5.2.1 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Dec 02, 2025

5.2.0 minor

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Nov 27, 2025

5.2.0.rc3 pre

Nov 18, 2025

5.2.0.rc2 pre

Nov 09, 2025

5.2.0.rc1 pre

Nov 04, 2025

5.1.8 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Oct 30, 2025

5.1.7 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Sep 29, 2025

5.1.6 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Sep 18, 2025

5.1.5 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Aug 06, 2025

5.0.6 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Aug 06, 2025

5.1.4 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jul 24, 2025

5.1.3 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jul 20, 2025

5.1.2 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jul 14, 2025

5.1.1 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jul 08, 2025

5.1.0 minor

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jul 03, 2025

5.1.0.rc1 pre

Jul 02, 2025

5.0.5 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Jun 30, 2025

5.1.0.beta4 pre

Jun 04, 2025

5.1.0.beta3 pre

May 29, 2025

5.0.4 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

May 22, 2025

5.1.0.beta2 pre

May 22, 2025

5.1.0.beta pre

May 20, 2025

5.0.3 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

May 06, 2025

5.0.2 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Apr 22, 2025

5.0.1 patch

1 CVE

CVE-2026-25757 GHSA-p6pv-q7rc-g4h9 Feb 05, 2026

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

High

Network Low None None

Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

As a guest create a complete order.
Fetch the latest Order ID from the database (Table: spree_orders).
In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Affected versions


          5.0.0


          5.0.0.rc1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.0.7


          5.1.0


          5.1.1


          5.1.2

+ 16 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.3.0


            5.3.1

Fixed in


          5.0.8


          5.1.10


          5.2.7


          5.3.2

References

Updated Feb 13, 2026 · Source: OSV.dev

Apr 09, 2025

Activity

Reach

Details