Spreecommerce Spree vulnerabilities

• spree Spree allows unauthenticated users can access all guest addresses CVE-2026-25758 Fix available 7.7 HighFebruary 5, 2026
• spree Unauthenticated Spree Commerce users can view completed guest orders by Order ID CVE-2026-25757 Fix available 7.7 HighFebruary 5, 2026
• spree Spree API has Unauthenticated IDOR - Guest Address CVE-2026-22589 Fix available 7.5 HighJanuary 8, 2026
• spree Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification CVE-2026-22588 Fix available 6.5 MediumJanuary 8, 2026
• spreecommerce spree, spreecommerce +1 more Spreecommerce < 0.50.x API RCE CVE-2011-10026 Public exploitFix available 9.3 CriticalAugust 20, 2025
• spreecommerce spree, spreecommerce +1 more Spreecommerce < 0.60.2 Search Parameter RCE CVE-2011-10019 Public exploitFix available 10.0 CriticalAugust 13, 2025
• spree auth devise, spreecommerce spree auth devise +1 more Authentication Bypass by CSRF Weakness CVE-2021-41275 Fix available 9.3 CriticalNovember 17, 2021
• spree Authorization bypass in Spree CVE-2020-26223 Fix available 7.7 HighNovember 13, 2020
• spreecommerce spree spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles CVE-2013-2506 Fix available 4.0 MediumMarch 8, 2013
• spreecommerce spree Spree Improper Input Validation vulnerability CVE-2013-1656 Fix available 4.3 MediumMarch 8, 2013
• spreecommerce spree Spree uses a hardcoded hash value CVE-2008-7311 Fix available 5.0 MediumApril 4, 2012
• spreecommerce spree Spree does not properly restrict the use of a hash to provide values for a model's attributes CVE-2008-7310 Fix available 5.0 MediumApril 4, 2012
• spreecommerce spree Spree allows remote attackers to obtain sensitive information CVE-2010-3978 Fix available 5.0 MediumNovember 17, 2010