spree vulnerabilities
8 published CVEs name spree among the affected products.
- 8Published CVEs8 of them scored
- 5Last 12 monthspublished in the last year
- 1Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-94462
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
spree · spree
High7.1 - CVE-2026-25757
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
spree · spree
High7.7 - CVE-2026-25758
Spree allows unauthenticated users can access all guest addresses
spree · spree
High7.7 - CVE-2026-22589
Spree API has Unauthenticated IDOR - Guest Address
spree · spree
High7.5 - CVE-2026-22588
Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification
spree · spree
Medium6.5 - CVE-2021-41275
Authentication Bypass by CSRF Weakness
spree · spree_auth_devise
Critical9.3 - CVE-2020-26223
Authorization bypass in Spree
spree · spree
High7.7 - CVE-2020-15269
Expired token reuse in Spree
spree · spree
High7.4