What’s Vulnerable › Vulnerabilities

CVE-2020-26223: Authorization bypass in Spree

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-13 · updated 2026-06-17
• Weakness: CWE-863

Description

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

Affected products

• spree: from 3.7.0 before 3.7.13; from 4.0.0 before 4.0.5; from 4.1.0 before 4.1.12 — fixed in 3.7.13, 4.0.5, 4.1.12

How to fix

Upgrade to a fixed version: spree 3.7.13, 4.0.5, 4.1.12. Check the vendor advisory for mitigations.

References

• https://github.com/spree/spree/pull/10573
• https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr
• https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status
• https://github.com/spree/spree/pull/10573
• https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr
• https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status

Get alerted when CVE-2020-26223 or the next vulnerability affects your stack