CVE-2026-94462

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.

• CWE-639

• https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd
• https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8
• https://github.com/spree/spree/pull/14314
• https://github.com/spree/spree/releases/tag/v5.4.4
• https://github.com/spree/spree/releases/tag/v5.5.4
• https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
• https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2

Published

Sep 22, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-94450Improper validation of the Destination Connection ID length …7.5
• CVE-2026-94455An HTTP endpoint intended for provisioning enterprise and re…7.1
• CVE-2026-94456Postiz generates security-sensitive credentials using `Math.…9.1
• CVE-2026-94457Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32…4.8
• CVE-2026-9446A vulnerability has been found in SourceCodester Simple POS …4.7
• CVE-2026-94461Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 ve…6.5
• CVE-2026-9447A vulnerability was found in SourceCodester Simple POS and I…7.3
• CVE-2026-9448A vulnerability was determined in code-projects Employee Man…4.3
• CVE-2026-94487Unauthenticated Cross Site Request Forgery (CSRF) in Publish…8.1
• CVE-2026-94488Telegram Desktop before 6.9.4 allows XSS in the HTML exporte…8.2
• CVE-2026-94489A vulnerability was identified in OctoPrint 1.0.0. Affected …4.3
• CVE-2026-9449A vulnerability was identified in code-projects Employee Man…6.3