CVE-2026-25757

5.3 MEDIUM
Published: February 06, 2026 Modified: February 23, 2026
View on NVD

Description

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14
Source: security-advisories@github.com
Patch
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8
Source: security-advisories@github.com
Patch
https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45
Source: security-advisories@github.com
Patch
https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab
Source: security-advisories@github.com
Patch
https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be
Source: security-advisories@github.com
Patch
https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d
Source: security-advisories@github.com
Patch
https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad
Source: security-advisories@github.com
Patch
https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9
Source: security-advisories@github.com
Exploit Vendor Advisory

8 reference(s) from NVD

Quick Stats

CVSS v3 Score
5.3 / 10.0
EPSS (Exploit Probability)
0.0%
9th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-639

Affected Vendors

spreecommerce

Related CVEs

CVE-2026-4552 8.8
CVE-2026-4551 8.8
CVE-2026-4550 4.7
CVE-2026-4549 3.1
CVE-2026-4548 6.3