CVE-2026-22588: 
Ruby vulnerability analysis and mitigation

CVE-2026-22588 is an Authenticated Insecure Direct Object Reference (IDOR) vulnerability in the Spree open-source e-commerce platform (built with Ruby on Rails) that allows authenticated users to retrieve other users' address information by manipulating address identifiers in order update requests. The vulnerability was disclosed on January 8, 2026, and affects Spree versions prior to 4.10.2, 5.0.0–5.0.6, 5.1.0–5.1.8, and 5.2.0–5.2.4. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the Spree::Checkout::Update service fails to verify that address identifiers supplied in bill_address_attributes or ship_address_attributes belong to the authenticated user placing the order. The vulnerable endpoint is PATCH /api/v2/storefront/checkout, where an attacker can substitute an arbitrary address id in the JSON body to reference another user's stored address. The backend then looks up and associates that address with the attacker's order without any ownership check, returning the victim's address data in the API response. The fix adds a validate_address_ownership method that checks address.user_id == order.user_id before processing the update (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to enumerate and retrieve personally identifiable information (PII) — specifically full name, street address, city, postal code, and country — belonging to any other registered user of the Spree store. The confidentiality impact is rated High, while integrity and availability are unaffected. Exposed address data could facilitate identity theft, fraud, social engineering, or targeted physical attacks against victims (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating the full attack flow with specific API requests. No evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.029% (0.000290), indicating low predicted exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid authenticated account and knowledge of sequential or guessable address IDs (GitHub Advisory, Feedly).

1. Obtain a valid account: Register or log in to the target Spree store as a legitimate user (e.g., attacker@example.com).
2. Create a shopping cart: Send POST /api/v2/storefront/cart and extract the order token from the response (e.g., A1cram_6cFWpoj4V1yPkuQ...).
3. Perform a legitimate checkout update: Send a PATCH /api/v2/storefront/checkout request with valid address attributes to confirm the endpoint is functional and to obtain your own address ID.
4. Enumerate target address IDs: Identify candidate address IDs belonging to other users by incrementing or guessing integer IDs (e.g., id: 1, id: 2, etc.).
5. Trigger the IDOR: Send a crafted PATCH /api/v2/storefront/checkout request substituting the victim's address ID:

{"include":"billing_address","order":{"bill_address_attributes":{"id":1}}}

6. Harvest PII: The server associates the victim's address with the attacker's order and returns the full address details (name, street, city, postal code, country) in the API response (GitHub Advisory).

• Network: Repeated PATCH /api/v2/storefront/checkout requests from a single authenticated session containing only {"order":{"bill_address_attributes":{"id":<integer>}}} or ship_address_attributes with sequentially or randomly varying id values and no other address fields.
• Logs: API access logs showing a single user token making many checkout update requests with different address IDs in rapid succession; HTTP 200 responses to such requests on unpatched instances.
• Application Behavior: Orders associated with billing or shipping addresses belonging to a different user account than the order owner — detectable via database queries comparing orders.user_id with addresses.user_id for bill/ship address records.

Upgrade Spree to one of the patched versions: 4.10.2, 5.0.7, 5.1.9, or 5.2.5. The fix introduces an address ownership validation check in core/app/services/spree/checkout/update.rb that rejects any request where the supplied address ID belongs to a different user. No official configuration-based workaround is available; upgrading is the only recommended remediation. Administrators should also review API access logs for suspicious patterns of address ID enumeration on checkout endpoints (GitHub Advisory, Patch Commit).

The vulnerability was covered in The Hacker News' weekly security recap in February 2026, which noted it among other notable disclosures (The Hacker News). A technical write-up was published by Infinit Security detailing the IDOR exploitation mechanics (Infinit Security). Community reaction has been moderate given the Medium severity rating and the requirement for authentication, though the public PoC in the advisory has drawn attention to the ease of exploitation.