Summary
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
Unauthenticated users can view completed guest orders by Order ID (GHSL-2026-029)
The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.
Order lookup without enforcing token requirement in OrdersController#show:
@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first
Authorization bypass for guest orders in authorize_access:
def authorize_access
return true if @order.user_id.nil?
@order.user == try_spree_current_user
end
If the attacker is in possession of a leaked Order ID, they might look it up directly via this API.
Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)
Proof of Concept
- As a guest create a complete order.
- Fetch the latest Order ID from the database (Table:
spree_orders). - In another clean browser access following URL:
<SPREE-HOST>/orders/<ORDER-ID>. (Sample:http://localhost:3000/orders/R496592563)
=> Full guest order details are disclosed including names, addresses and limited payment info.
CWEs
- CWE-639: Authorization Bypass Through User-Controlled Key
Credit
This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).
Disclosure Policy
This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.
Impact
This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
spree_storefront to 5.0.8 or later; spree_storefront to 5.1.10 or later; spree_storefront to 5.2.7 or later; spree_storefront to 5.3.2 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-25757? CVE-2026-25757 is a high-severity security vulnerability in spree_storefront (rubygems), affecting versions < 5.0.8. It is fixed in 5.0.8, 5.1.10, 5.2.7, 5.3.2.
- Which versions of spree_storefront are affected by CVE-2026-25757? spree_storefront (rubygems) versions < 5.0.8 is affected.
- Is there a fix for CVE-2026-25757? Yes. CVE-2026-25757 is fixed in 5.0.8, 5.1.10, 5.2.7, 5.3.2. Upgrade to this version or later.
- Is CVE-2026-25757 exploitable, and should I be worried? Whether CVE-2026-25757 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-25757 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-25757?
- Upgrade
spree_storefrontto 5.0.8 or later - Upgrade
spree_storefrontto 5.1.10 or later - Upgrade
spree_storefrontto 5.2.7 or later - Upgrade
spree_storefrontto 5.3.2 or later
- Upgrade