Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

🗓️ 08 Jan 2026 21:27:03Reported by GitHub Advisory DatabaseType

Authenticated user can modify an order to attach another user's address due to missing object-level authorization.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-22588	8 Jan 202611:19	–	circl
CNNVD	Spree 安全漏洞	8 Jan 202600:00	–	cnnvd
CVE	CVE-2026-22588	8 Jan 202620:53	–	cve
Cvelist	CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification	8 Jan 202620:53	–	cvelist
EUVD	EUVD-2026-1421	8 Jan 202620:53	–	euvd
NVD	CVE-2026-22588	8 Jan 202621:15	–	nvd
OSV	CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification	8 Jan 202620:53	–	osv
OSV	GHSA-G268-72P7-9J6J Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification	8 Jan 202621:27	–	osv
Positive Technologies	PT-2026-2214	8 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-22588	10 Jan 202605:40	–	redhatcve

Vulners

Node

spree_apiRange5.2.0–5.2.5rubygems

spree_apiRange5.1.0–5.1.9rubygems

spree_apiRange5.0.0–5.0.7rubygems

spree_apiRange3.7.0–4.10.2rubygems

Source	Link
github	www.github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j
github	www.github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72
github	www.github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3
github	www.github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8
github	www.github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-22588
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2026-22588.yml
github	www.github.com/advisories/GHSA-g268-72p7-9j6j

11 Jan 2026 14:57Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.5

EPSS0.00017

SSVC