CVE-2026-22589: 
Ruby vulnerability analysis and mitigation

CVE-2026-22589 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in the Spree e-commerce framework (Ruby gem spree_core) that allows unauthenticated attackers to enumerate and retrieve guest address information via the storefront's address edit endpoint. The vulnerability affects Spree versions before 4.10.2, 5.0.0–5.0.6, 5.1.0–5.1.8, and 5.2.0–5.2.4. It was disclosed on January 8, 2026, via a GitHub Security Advisory. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory).

The root cause is a faulty authorization check in Spree's CanCanCan Ability class (CWE-639: Authorization Bypass Through User-Controlled Key). In vulnerable versions, the permission rule can :manage, ::Spree::Address, user_id: user.id was applied unconditionally, including for non-persisted guest user objects (Spree.user_class.new). Because guest users have a user_id of nil, and guest addresses also have user_id: nil, the condition matched all guest addresses, allowing any unauthenticated request to access any guest address record by simply supplying an arbitrary integer ID to the /addresses/{addressId}/edit endpoint. The fix adds a if user.persisted? guard to ensure address management permissions are only granted to authenticated, database-backed users (GitHub Advisory, Patch Commit). Headless API builds are not affected, as the addresses endpoint there is scoped to signed-in users only.

An unauthenticated attacker can enumerate and retrieve personally identifiable information (PII) associated with guest checkout accounts, including full names, physical addresses, and phone numbers. Addresses linked to registered user accounts are not affected. The primary impacts are privacy violations, potential regulatory compliance failures (e.g., GDPR), and loss of customer trust in affected storefronts (GitHub Advisory).

A proof-of-concept is publicly documented in the official security advisory, demonstrating exploitation via simple sequential GET requests to /addresses/{id}/edit without any authentication or session cookies. No evidence of in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.044% (0.000440), indicating low current exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Spree-powered storefront running a vulnerable version (before 4.10.2, 5.0.0–5.0.6, 5.1.0–5.1.8, or 5.2.0–5.2.4). The URL structure can be learned by creating a registered user account on the target store.
2. Identify the vulnerable endpoint: Locate the address edit endpoint at /addresses/{addressId}/edit on the storefront (part of the spree_storefront gem).
3. Send unauthenticated GET request: Issue a GET request to /addresses/1/edit (or any integer ID) without any authentication headers, session cookies, or CSRF tokens.
4. Enumerate address IDs: Iterate through sequential integer IDs (e.g., /addresses/1/edit, /addresses/2/edit, etc.) to enumerate all guest addresses stored in the system.
5. Harvest PII: Parse the HTTP responses to extract guest PII including full names, physical addresses, and phone numbers associated with each address record (GitHub Advisory).

• Network: High volume of sequential GET requests to /addresses/<integer>/edit from a single IP or user agent without session cookies or authentication headers; requests originating from automated tools (e.g., curl, Python requests, scripted browsers).
• Logs: Web server or application access logs showing repeated unauthenticated requests to the /addresses/*/edit pattern with incrementing numeric IDs and HTTP 200 responses; absence of session or authentication tokens in corresponding log entries.
• Application: Unusual access patterns to the Spree::Address model for records with user_id: nil (guest addresses) outside of normal checkout flows.

Upgrade spree_core to one of the patched versions: 4.10.2, 5.0.7, 5.1.9, or 5.2.5, depending on the currently installed branch. The fix adds a before_action :require_user to the AddressesController and guards the CanCanCan ability rule with if user.persisted?, preventing unauthenticated access entirely. No configuration-based workaround is available; upgrading is the only remediation. Operators should also review access logs to determine whether exploitation occurred prior to patching (GitHub Advisory, Patch Commit).

The vulnerability was disclosed by Spree maintainer damianlegawiec via the official GitHub Security Advisory on January 8, 2026. It received coverage in security aggregators including RubySec, CIRCL vulnerability database, and cybersecurity news digests. The Hacker News weekly recap for early February 2026 included mention of the vulnerability among notable disclosures (RubySec, The Hacker News).