SB2026042781 - Multiple vulnerabilities in spree_api

Description

This security bulletin contains information about 2 vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-22588)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the order update endpoint when handling crafted checkout update requests with user-controlled address identifiers. A remote user can modify address identifiers in a request to disclose sensitive information.

The issue affects the /api/v2/storefront/checkout endpoint and requires a valid authenticated account and an order the user is authorized to modify.

2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-22589)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in the address edit endpoint when handling crafted requests to /addresses/{addressId}/edit. A remote attacker can manipulate the address identifier in a request to disclose sensitive information.

Only guest address records are affected; addresses associated with registered user accounts are not affected. Headless builds using APIs are not affected.

Remediation

Install update from vendor's website.

References

• https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j
• https://github.com/advisories/GHSA-g268-72p7-9j6j
• https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr
• https://github.com/advisories/GHSA-3ghg-3787-w2xr