{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aspreecommercespree/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-94462"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["spree_api (5.4.0 - 5.4.3, 5.5.0 - 5.5.3)"],"_cs_severities":["high"],"_cs_tags":["idor","broken-access-control","spree","pii-exposure"],"_cs_type":"threat","_cs_vendors":["Spree"],"content_html":"\u003cp\u003eSpree versions 5.4.0 through 5.4.3 and 5.5.0 through 5.5.3 contain a high-severity Insecure Direct Object Reference (IDOR) vulnerability in the \u003ccode\u003ePATCH /api/v3/store/carts/:id/associate\u003c/code\u003e endpoint. The vulnerability arises because the controller fails to perform the standard \u003ccode\u003eauthorize!(:update, @cart, cart_token)\u003c/code\u003e check for the association process. Instead, it relies on a \u003ccode\u003eprefixed_id\u003c/code\u003e which is generated via reversible Sqids encoding of sequential database primary keys. An authenticated store user can derive candidate cart IDs offline and iterate through them, associating victim guest carts to their own account. Successful exploitation permits the attacker to read sensitive customer checkout information, including full names, street addresses, and phone numbers stored in the guest cart objects.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker registers an ordinary customer account on the target Spree storefront.\u003c/li\u003e\n\u003cli\u003eAttacker logs into the store via \u003ccode\u003ePOST /api/v3/store/auth/login\u003c/code\u003e to obtain a valid session JWT.\u003c/li\u003e\n\u003cli\u003eAttacker uses the known Sqids algorithm and target sequential database IDs to generate a list of candidate \u003ccode\u003eprefixed_id\u003c/code\u003e strings (e.g., \u003ccode\u003ecart_XXXXXXXXXX\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker iterates through the generated list, sending \u003ccode\u003ePATCH /api/v3/store/carts/:id/associate\u003c/code\u003e requests for each candidate ID.\u003c/li\u003e\n\u003cli\u003eThe backend controller processes the request, locates the guest cart via \u003ccode\u003efind_cart_for_association\u003c/code\u003e, and skips the required authorization check.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eSpree.cart_associate_service\u003c/code\u003e reassigns the guest order to the attacker's account and overwrites the associated email address.\u003c/li\u003e\n\u003cli\u003eThe API returns a \u003ccode\u003e200 OK\u003c/code\u003e response containing the serialized customer PII (billing and shipping addresses) previously stored on the victim's guest cart.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized exposure of personally identifiable information (PII) including names, physical addresses, and contact details for store guests. Furthermore, it causes a disruption to the original guest's shopping experience as their in-progress cart is hijacked and reassigned to the attacker's account. This affects any Spree-based storefront not running in \u003ccode\u003elogin_required\u003c/code\u003e mode.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for administrators:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Spree backend components to version 5.4.4 or 5.5.4 immediately to address CVE-2026-94462.\u003c/li\u003e\n\u003cli\u003eAudit access logs for high-frequency \u003ccode\u003ePATCH\u003c/code\u003e requests to the \u003ccode\u003e/api/v3/store/carts/\u003c/code\u003e endpoint originating from single authenticated user sessions.\u003c/li\u003e\n\u003cli\u003eMonitor for anomalous \u003ccode\u003e404\u003c/code\u003e or \u003ccode\u003e422\u003c/code\u003e error patterns on the association endpoint which may indicate automated ID enumeration attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-23T01:54:53Z","date_published":"2026-09-23T01:54:53Z","id":"https://feed.craftedsignal.io/briefs/2026-09-spree-idor/","summary":"An Insecure Direct Object Reference (IDOR) vulnerability in the Spree API v3 allows authenticated users to associate and exfiltrate PII from arbitrary guest carts using reversible Sqids identifiers.","title":"IDOR Vulnerability in Spree API Associate Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-09-spree-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}