CVE-2020-15269

The CVE applies to Spree releases prior to 3.7.11, 4.0.4, and 4.1.11, where expired user tokens could be reused to access Storefront API v2 endpoints. Root cause: expired tokens could authenticate to API v2; patch versions are 3.7.11, 4.0.4, and 4.1.11 (or newer). A workaround without upgrading i...