Every CVE Search/ Get API key

CVE-2020-15269

Expired token reuse in Spree

7.4 HighFix available

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.06%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.4

Expired token reuse in Spree

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Record
CVE-2020-15269
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-287, CWE-613
Updated
2026-11-02
EUVDEUVD-2020-1427 7.4

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Record
EUVD-2020-1427
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-f8cm-364f-q9qh 7.4

Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

Impact

The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints.

Patches

Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.

Workarounds

In your project directory create a decorator file app/controllers/spree/api/v2/base_controller_decotatror.rb with contents:

module Spree
  module Api
    module V2
      module BaseControllerDecorator
        private

        def spree_current_user
          return nil unless doorkeeper_token
          return @spree_current_user if @spree_current_user

          doorkeeper_authorize!

          @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)
        end
     end
  end
end

Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)

For more information

If you have any questions or comments about this advisory:

Record
GHSA-f8cm-364f-q9qh
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-287, CWE-613
Updated
2026-11-02
NVD 7.4

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Record
CVE-2020-15269
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-287, CWE-613
Updated
2026-11-02
OSV 9.1

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Record
CVE-2020-15269
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVGHSA-f8cm-364f-q9qh 7.4

Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

Impact

The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints.

Patches

Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.

Workarounds

In your project directory create a decorator file app/controllers/spree/api/v2/base_controller_decotatror.rb with contents:

module Spree
  module Api
    module V2
      module BaseControllerDecorator
        private

        def spree_current_user
          return nil unless doorkeeper_token
          return @spree_current_user if @spree_current_user

          doorkeeper_authorize!

          @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)
        end
     end
  end
end

Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)

For more information

If you have any questions or comments about this advisory:

Record
GHSA-f8cm-364f-q9qh
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-287, CWE-613
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
spree
RubyGems
 before 3.7.11
3.7.11
spree
RubyGems
 4.0.0 up to 4.0.4
4.0.4
spree
RubyGems
 4.1.0 up to 4.1.11
4.1.11
spree
RubyGems
 before 3.7.11, plus listed versions
0.0.50.0.60.0.70.0.80.0.9
Show 45 moreShow less
0.10.00.10.0.beta0.10.10.10.20.11.00.11.10.11.20.11.30.11.40.2.00.30.00.30.0.beta10.30.10.30.20.4.00.4.10.40.00.40.10.40.20.40.30.40.40.5.00.5.10.50.00.50.10.50.20.50.30.50.40.6.00.60.00.60.0.RC10.60.10.60.20.60.30.60.40.60.50.60.60.7.00.7.10.70.00.70.0.rc20.70.10.70.20.70.30.70.4
3.7.11
spree
RubyGems
 4.0.0 up to 4.0.4, plus listed versions
4.0.14.0.24.0.3
4.0.4
spree
RubyGems
 4.1.0 up to 4.1.11, plus listed versions
4.1.14.1.104.1.24.1.34.1.4
Show 5 moreShow less
4.1.54.1.64.1.74.1.84.1.9
4.1.11

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15269 is a high vulnerability (CVSS 7.4) in Sparksolutions Spree, published October 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in spree 3.7.11.

References

This page doesn't list everything

Left out here: 213 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open