CVE-2026-25757: 
Ruby vulnerability analysis and mitigation

CVE-2026-25757 is an authorization bypass vulnerability in Spree, an open-source Ruby on Rails e-commerce platform, that allows unauthenticated users to view completed guest orders by Order ID alone. The flaw was discovered by the GitHub Security Lab (GHSL-2026-029) and disclosed on February 5, 2026. Affected versions include all Spree releases prior to 5.0.8, 5.1.10, 5.2.7, and 5.3.2. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory).

The root cause is an authorization bypass through a user-controlled key (CWE-639) in the OrdersController#show action of the Spree storefront. The vulnerable authorize_access method unconditionally returns true for any order where user_id is nil (i.e., guest orders), meaning no order token is required to view the order — only the Order ID is needed (GitHub Advisory, Spree Orders Controller). Order IDs are numerically generated with a default length of 9 digits in base 10, yielding a search space of 1 billion possible values — brute-forceable at ~100 requests/second in approximately 115 days (GitHub Advisory, Number Generator). The fix replaces the flawed authorize_access method with a CanCan-based authorize! :show, @order, params[:token] call that enforces token validation (Patch Commit).

Successful exploitation allows any unauthenticated attacker to access completed guest order details, exposing personally identifiable information (PII) including customer names, shipping addresses, phone numbers, and limited payment information. There is no integrity or availability impact — the vulnerability is purely a confidentiality issue affecting guest shoppers on any unpatched Spree storefront. The scope is limited to the vulnerable system, but the exposure of PII at scale could affect large numbers of customers and create regulatory liability (e.g., GDPR, CCPA) for operators (GitHub Advisory).

A proof-of-concept is described in the GitHub Security Advisory: an attacker simply navigates to /orders/<ORDER_ID> (e.g., http://localhost:3000/orders/R496592563) without any authentication or token to retrieve full guest order details (GitHub Advisory). The CVSS v4.0 exploit maturity is rated "Proof of Concept." There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.029% (11th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify a target Spree-based e-commerce site running a vulnerable version (prior to 5.0.8, 5.1.10, 5.2.7, or 5.3.2). This can be done by inspecting HTTP response headers, page source, or known Spree URL patterns (e.g., /cart, /checkout).
2. Obtain or enumerate an Order ID: Either obtain a leaked Order ID (e.g., from a confirmation email, referrer header, or other disclosure), or enumerate IDs by brute force. Default Spree Order IDs are 9-digit numeric strings prefixed with 'R' (e.g., R496592563), yielding a 1-billion-entry search space.
3. Send unauthenticated request: Without any session cookie or order token, send an HTTP GET request directly to /orders/<ORDER_ID> (e.g., GET /orders/R496592563 HTTP/1.1).
4. Retrieve guest PII: If the order is a completed guest order, the server returns the full order details page including the guest's name, shipping address, phone number, and limited payment information — no authentication or token required (GitHub Advisory).

• Network: High volume of HTTP GET requests to /orders/R<9-digit-number> endpoints from a single IP or distributed set of IPs, particularly without a token query parameter; sequential or randomized numeric patterns in the order number portion of the URL.
• Logs: Web server or Rails application logs showing repeated GET /orders/R* requests returning HTTP 200 responses without an associated authenticated session or token parameter; requests originating from automated tools (e.g., unusual User-Agent strings, high request rates).
• Application: Absence of token parameter in order lookup requests that still result in successful order page renders for guest orders.

Operators should immediately upgrade Spree to one of the patched versions: 5.0.8, 5.1.10, 5.2.7, or 5.3.2, depending on their current branch (GitHub Advisory). The fix enforces token-based authorization via CanCan's authorize! :show, @order, params[:token], ensuring guest orders cannot be accessed without the correct order token (Patch Commit). No configuration-based workaround is documented; upgrading is the only recommended remediation. As an interim measure, operators may consider rate-limiting or blocking requests to /orders/* endpoints that lack a token parameter at the web server or WAF layer.

The vulnerability was discovered using the GitHub Security Lab Taskflow Agent and manually verified by GHSL researchers Peter Stöckli (@p-) and Man Yue Mo (@m-y-mo), representing a notable use of AI-assisted vulnerability discovery (GitHub Advisory). A GitHub Security Lab advisory (GHSL-2026-029) was published following a 90-day coordinated disclosure process. No significant broader media coverage or social media discussion has been identified beyond the official advisory.