Spree_api (5.4.0 - 5.4.3, 5.5.0 - 5.5.3)

An Insecure Direct Object Reference (IDOR) vulnerability in the Spree API v3 allows authenticated users to associate and exfiltrate PII from arbitrary guest carts using reversible Sqids identifiers.