Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00021.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
spree spree affected
Version Status Constraints
< 5.0.8 affected —
>= 5.1.0, < 5.1.10 affected —
>= 5.2.0, < 5.2.7 affected —
>= 5.3.0, < 5.3.2 affected —

Configuration 1 [-]

OR cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*
cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*
cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*
cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Spree Subscribe
Spree Subscribe

Project Subscriptions

Vendors Products
Spree Subscribe
Spree Subscribe
Spreecommerce Subscribe
Spree Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-p6pv-q7rc-g4h9 Unauthenticated Spree Commerce users can view completed guest orders by Order ID
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14 cve-icon cve-icon
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8 cve-icon cve-icon
https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45 cve-icon cve-icon
https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab cve-icon cve-icon
https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be cve-icon cve-icon
https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d cve-icon cve-icon
https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad cve-icon cve-icon
https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9 cve-icon cve-icon
History

Mon, 23 Feb 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Spreecommerce
Spreecommerce spree
CPEs cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*
Vendors & Products Spreecommerce
Spreecommerce spree
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Mon, 09 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Spree
Spree spree
Vendors & Products Spree
Spree spree

Fri, 06 Feb 2026 22:45:00 +0000

Type Values Removed Values Added
Description Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
Title Unauthenticated Spree Commerce users can view completed guest orders by Order ID
Weaknesses CWE-639
References
Metrics cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-02-09T15:26:28.967Z

Reserved: 2026-02-05T18:35:52.357Z

Link: CVE-2026-25757

cve-icon Vulnrichment

Updated: 2026-02-09T15:21:53.488Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-06T23:15:54.527

Modified: 2026-02-23T17:40:58.347

Link: CVE-2026-25757

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-02-09T10:44:58Z

Weaknesses