What’s Vulnerable › Products

spree vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your spree version is affected

Latest spree vulnerabilities

• CVE-2026-94462 — Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR) (CVSS 7.1)
• CVE-2026-25757 — Unauthenticated Spree Commerce users can view completed guest orders by Order ID (CVSS 5.3)
• CVE-2026-25758 — Spree allows unauthenticated users can access all guest addresses (CVSS 7.5)
• CVE-2026-22589 — Spree API has Unauthenticated IDOR - Guest Address (CVSS 7.5)
• CVE-2026-22588 — Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification (CVSS 6.5)
• CVE-2011-10026 — Spreecommerce < 0.50.x API RCE (CVSS 9.8)
• CVE-2011-10019 — Spreecommerce < 0.60.2 Search Parameter RCE (CVSS 9.8)
• CVE-2020-26223 — Authorization bypass in Spree (CVSS 6.5)
• CVE-2013-2506 — (CVSS 4.0)
• CVE-2013-1656 — (CVSS 4.3)
• CVE-2008-7311 — (CVSS 5.0)
• CVE-2008-7310 — (CVSS 5.0)
• CVE-2010-3978 — (CVSS 5.0)