--- title: Spree Commerce Security Vulnerabilities: Access to Guest... description: Spree Commerce patched two critical security vulnerabilities that allowed unauthenticated users to access sensitive guest data. The first vulnerability (IDOR)... canonical: https://daily.dev/posts/spree-commerce-security-vulnerabilities-access-to-guest-addresses-and-orders-by-unauthenticated-use-fb8vvabwn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Spree Commerce Security Vulnerabilities: Access to Guest Addresses and Orders by Unauthenticated Users | daily.dev og:description: Spree Commerce patched two critical security vulnerabilities that allowed unauthenticated users to access sensitive guest data. The first vulnerability (IDOR)... og:url: https://daily.dev/posts/spree-commerce-security-vulnerabilities-access-to-guest-addresses-and-orders-by-unauthenticated-use-fb8vvabwn og:image: https://api.daily.dev/og/posts/Fb8vvabWN.png og:image:alt: Spree Commerce Security Vulnerabilities: Access to Guest Addresses and Orders by Unauthenticated Users og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Spree Commerce Security Vulnerabilities: Access to Guest Addresses and Orders by Unauthenticated Users **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary Spree Commerce patched two critical security vulnerabilities that allowed unauthenticated users to access sensitive guest data. The first vulnerability (IDOR) enabled attackers to enumerate and retrieve guest addresses by manipulating ID parameters during checkout. The second flaw allowed unauthorized viewing of completed guest orders through inadequate order token validation. Patches are available for versions 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2+, with immediate upgrades strongly recommended. ## Content Spree Commerce has recently addressed two critical security vulnerabilities affecting the platform, which could potentially expose personal information of users. Both vulnerabilities allow unauthenticated users to access sensitive data without proper authorization. ### Vulnerability in Spree API: Guest Address Exposure A major issue identified as an Insecure Direct Object Reference (IDOR) vulnerability was found in Spree Commerce's API. This flaw permits unauthenticated guest users to access the personal information of other guests by altering the plain ID parameters related to addresses (such as `bill_address_id` and `ship_address_id`) during the checkout process. The vulnerability circumvents ownership validation, which is only applied to nested attributes, leaving plain ID parameters exposed. As a result, attackers can sequentially enumerate address IDs to retrieve sensitive data such as names, addresses, and phone numbers of other guests. Patches have been released for versions 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2+ to mitigate this risk. ### Vulnerability in Spree Storefront: Unauthorized Order Access Another critical vulnerability was found in the Spree Storefront, allowing unauthenticated users to view completed guest orders simply by knowing the Order ID. This issue arises because the `OrdersController#show` action doesn't adequately enforce the order token validation for accessing guest orders, opening the door to potential Personal Identifiable Information (PII) disclosure through brute force attacks. The issue, identified as CWE-639, was discovered by the GitHub Security Lab. To address this, patches have been provided for the same set of versions: 5.0.8, 5.1.10, 5.2.7, and 5.3.2+. In response to these vulnerabilities, Spree Commerce strongly recommends upgrading to the patched versions to enhance the security and privacy of users. Regular updates and adherence to the latest security practices are vital to protect against such vulnerabilities. ## Similar posts on daily.dev - [CVE-2026-22589 \(spree\_core\): Spree API has Unauthenticated IDOR](https://daily.dev/posts/cve-2026-22589-spree-core-spree-api-has-unauthenticated-idor-olszibwc5) · RUBYLAND · 0 upvotes · 0 comments - [CVE-2026-22588 \(spree\_api\): Spree API has Authenticated Insecure Direct Object Reference \(IDOR\) via Order Modification](https://daily.dev/posts/cve-2026-22588-spree-api-spree-api-has-authenticated-insecure-direct-object-reference-idor-via--clmuodsiy) · RUBYLAND · 0 upvotes · 0 comments - [Hackers exploit critical Adobe Commerce flaw to hijack customer accounts](https://daily.dev/posts/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts-cke5dsk3l) · BleepingComputer · 0 upvotes · 0 comments - [Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw](https://daily.dev/posts/over-250-magento-stores-hit-overnight-as-hackers-exploit-new-adobe-commerce-flaw-vp64hkl5b) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby), [#ecommerce](https://daily.dev/tags/ecommerce) [View this post on daily.dev](https://daily.dev/posts/spree-commerce-security-vulnerabilities-access-to-guest-addresses-and-orders-by-unauthenticated-use-fb8vvabwn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Spree Commerce Security Vulnerabilities: Access to Guest Addresses and Orders by Unauthenticated Users","url":"https://daily.dev/posts/spree-commerce-security-vulnerabilities-access-to-guest-addresses-and-orders-by-unauthenticated-use-fb8vvabwn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/spree-commerce-security-vulnerabilities-access-to-guest-addresses-and-orders-by-unauthenticated-use-fb8vvabwn"},"datePublished":"2026-02-08T06:10:03.978Z","dateModified":"2026-02-08T06:11:47.176Z","description":"Spree Commerce patched two critical security vulnerabilities that allowed unauthenticated users to access sensitive guest data. The first vulnerability (IDOR)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEunF","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEunF","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/spree-commerce-security-vulnerabilities-access-to-guest-addresses-and-orders-by-unauthenticated-use-fb8vvabwn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby,ecommerce","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Spree Commerce Security Vulnerabilities: Access to Guest Addresses and Orders by Unauthenticated Users"}]} ```