ADVISORIES

• GHSA-87fh-rc96-6fr6
• Vendor Advisory

GEM

spree_api

PATCHED VERSIONS

• ~> 4.10.3
• ~> 5.0.8
• ~> 5.1.10
• ~> 5.2.7
• >= 5.3.2

DESCRIPTION

Summary

A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

Unauthenticated users can access all guest addresses (GHSL-2026-027)

The vulnerability stems from incomplete authorization validation in Spree's checkout address assignment logic. While nested address attributes (bill_address_attributes[id] and ship_address_attributes[id]) are properly validated through validate_address_ownership, plain ID parameters (bill_address_id and ship_address_id) bypass this check entirely. Since Spree's address IDs are sequential numbers, an attacker might get all guest addresses by simply enumerating over them.

Affected Code Components

1. Permitted Attributes (core/lib/spree/permitted_attributes.rb:92–96)
   • Allows bill_address_id and ship_address_id as permitted parameters without validation
2. Checkout Update (core/app/models/spree/order/checkout.rb:241–254)
   • Applies permitted parameters directly to the Order model via update_from_params
3. Incomplete Ownership Validation (core/app/services/spree/checkout/update.rb:33–48)
   • validate_address_ownership only validates nested attributes structure
   • Does NOT validate plain bill_address_id/ship_address_id fields
4. Vulnerable Assignment Logic (core/app/models/spree/order/address_book.rb:16–23, 31–38)
   • bill_address_id= setter
   • ship_address_id= setter

Both setters check that: address.user_id == order.user_id. For guest orders: nil == nil → TRUE ✓ (bypass!)

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

• CWE-639: Authorization Bypass Through User-Controlled Key
• CWE-284: Improper Access Control

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

RELATED

• https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
• https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734
• https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f
• https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8
• https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748
• https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054
• https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38
• https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254
• https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48
• https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96
• https://github.com/advisories/GHSA-87fh-rc96-6fr6