CVE-2026-22588
Last modified
CVE-2026-22588 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying an existing order. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker’s order and returning them in the response. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Spreecommerce | Spree | < 4.10.2 |
| Spreecommerce | Spree | >= 5.0.0, < 5.0.7 |
| Spreecommerce | Spree | >= 5.1.0, < 5.1.9 |
| Spreecommerce | Spree | >= 5.2.0, < 5.2.5 |
References
- https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6jExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-22588?
How severe is CVE-2026-22588?
How do I fix CVE-2026-22588?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-22582Improper Neutralization of Argument Delimiters in a Command …9.8
- CVE-2026-22583Improper Neutralization of Argument Delimiters in a Command …9.8
- CVE-2026-22584Improper Control of Generation of Code ('Code Injection') vu…9.8
- CVE-2026-22585Use of a Broken or Risky Cryptographic Algorithm vulnerabili…9.8
- CVE-2026-22586Hard-coded Cryptographic Key vulnerability in Salesforce Mar…9.8
- CVE-2026-22587Ideagen DevonWay contains a stored cross site scripting vuln…5.5
- CVE-2026-22589Spree is an open source e-commerce solution built with Ruby …7.5
- CVE-2026-2259A vulnerability has been found in aardappel lobster up to 20…5.5
- CVE-2026-22592Gogs is an open source self-hosted Git service. In version 0…6.5
- CVE-2026-22593EVerest is an EV charging software stack. Prior to version 2…7.8
- CVE-2026-22594Ghost is a Node.js content management system. In versions 5.…8.1
- CVE-2026-22595Ghost is a Node.js content management system. In versions 5.…8.1
Are you affected by CVE-2026-22588?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST