CVE-2020-15269: Expired token reuse in Spree

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-20 · updated 2026-06-17
Weakness: CWE-287

Description

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Affected products

Sparksolutions Spree: before 3.7.11; from 4.0.0 before 4.0.4; from 4.1.0 before 4.1.11 — fixed in 3.7.11, 4.0.4, 4.1.11

How to fix

Upgrade to a fixed version: Sparksolutions Spree 3.7.11, 4.0.4, 4.1.11. Check the vendor advisory for mitigations.

References

https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847
https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh
https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847
https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh

Get alerted when CVE-2020-15269 or the next vulnerability affects your stack