CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses

🗓️ 06 Feb 2026 21:29:20Reported by GoogleType

osv

osv🔗 osv.dev👁 11 Views

Unauthenticated users can bind arbitrary guest addresses in Spree checkout, exposing others' PII.

Source	Link
github	www.github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb
github	www.github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb
github	www.github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb
github	www.github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25758.json
github	www.github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-25758
github	www.github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734
github	www.github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f
github	www.github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8

12 Aug 2026 03:51Current

5.6Medium risk

Vulners AI Score5.6

CVSS 48.7

guest addresses access Spree checkout flaw unauthenticated access PII exposure