CVE-2020-26223

Authorization bypass in Spree

State: Published
Severity: 7.7 High
Published: Nov 13, 2020
Updated: Aug 4, 2024
Reserved: Oct 1, 2020

Description

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
spreespree	>= 3.7.0, < 3.7.13Affected >= 4.0.0, < 4.0.5Affected >= 4.1.0, < 4.1.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.