Vendor
An Insecure Direct Object Reference (IDOR) vulnerability in the Spree API v3 allows authenticated users to associate and exfiltrate PII from arbitrary guest carts using reversible Sqids identifiers.