Skip to content
Threat Feed
Subscribe

Tag

Spree

1 brief RSS
high threat

IDOR Vulnerability in Spree API Associate Endpoint

An Insecure Direct Object Reference (IDOR) vulnerability in the Spree API v3 allows authenticated users to associate and exfiltrate PII from arbitrary guest carts using reversible Sqids identifiers.

exploited spree_api idor broken-access-control spree pii-exposure
1t 1c