Skip to content

Commit 337ffe5

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@f118d91 
1 parent e24bb83 commit 337ffe5

File tree

2 files changed

+189
-0
lines changed

2 files changed

+189
-0
lines changed

‎advisories/_posts/2026-02-05-GHSA-87fh-rc96-6fr6.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-87fh-rc96-6fr6 (spree_api): Unauthenticated Spree Commerce users can
4+
access all guest addresses'
5+
comments: false
6+
categories:
7+
- spree_api
8+
advisory:
9+
gem: spree_api
10+
ghsa: 87fh-rc96-6fr6
11+
url: https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
12+
title: Unauthenticated Spree Commerce users can access all guest addresses
13+
date: 2026-02-05
14+
description: |
15+
### Summary
16+
17+
A critical IDOR vulnerability exists in Spree Commerce's guest
18+
checkout flow that allows any guest user to bind arbitrary guest
19+
addresses to their order by manipulating address ID parameters.
20+
This enables unauthorized access to other guests' personally
21+
identifiable information (PII) including names, addresses and
22+
phone numbers. The vulnerability bypasses existing ownership
23+
validation checks and affects all guest checkout transactions.
24+
25+
### Impact
26+
27+
This issue may lead to disclosure of PII of guest users (including
28+
names, addresses and phone numbers).
29+
30+
### Unauthenticated users can access all guest addresses (`GHSL-2026-027`)
31+
32+
The vulnerability stems from incomplete authorization validation
33+
in Spree's checkout address assignment logic. While nested address
34+
attributes (`bill_address_attributes[id]` and
35+
`ship_address_attributes[id]`) are properly validated through
36+
`validate_address_ownership`, plain ID parameters (`bill_address_id`
37+
and `ship_address_id`) bypass this check entirely. Since Spree's
38+
address IDs are sequential numbers, an attacker might get all
39+
guest addresses by simply enumerating over them.
40+
41+
### Affected Code Components
42+
43+
1. **Permitted Attributes** ([`core/lib/spree/permitted_attributes.rb:92–96`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96))
44+
- Allows `bill_address_id` and `ship_address_id` as permitted
45+
parameters without validation
46+
47+
2. **Checkout Update** ([`core/app/models/spree/order/checkout.rb:241–254`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254))
48+
- Applies permitted parameters directly to the Order model
49+
via `update_from_params`
50+
51+
3. **Incomplete Ownership Validation** ([`core/app/services/spree/checkout/update.rb:33–48`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48))
52+
- `validate_address_ownership` only validates nested attributes structure
53+
- Does NOT validate plain `bill_address_id`/`ship_address_id` fields
54+
55+
4. **Vulnerable Assignment Logic** ([`core/app/models/spree/order/address_book.rb:16–23, 31–38`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38))
56+
* [`bill_address_id=` setter](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L24)
57+
* [`ship_address_id=` setter](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L31-L39)
58+
59+
Both setters check that: `address.user_id == order.user_id`. For
60+
guest orders: nil == nil → TRUE ✓ (bypass!)
61+
62+
#### Impact
63+
64+
This issue may lead to disclosure of PII of guest users (including
65+
names, addresses and phone numbers).
66+
67+
#### CWEs
68+
69+
- CWE-639: Authorization Bypass Through User-Controlled Key
70+
- CWE-284: Improper Access Control
71+
72+
### Credit
73+
74+
This issue was discovered with the [GitHub Security Lab Taskflow
75+
Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent)
76+
and manually verified by GHSL team members
77+
[@p- (Peter Stöckli)](https://github.com/p-) and
78+
[@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).
79+
80+
### Disclosure Policy
81+
82+
This report is subject to a 90-day disclosure deadline, as
83+
described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).
84+
patched_versions:
85+
- "~> 4.10.3"
86+
- "~> 5.0.8"
87+
- "~> 5.1.10"
88+
- "~> 5.2.7"
89+
- ">= 5.3.2"
90+
related:
91+
url:
92+
- https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
93+
- https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734
94+
- https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f
95+
- https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8
96+
- https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748
97+
- https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054
98+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38
99+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254
100+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48
101+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96
102+
- https://github.com/advisories/GHSA-87fh-rc96-6fr6
103+
notes: "- CVE-2026-25758 in GHSA Advisory.\n"
104+
---

‎advisories/_posts/2026-02-05-GHSA-p6pv-q7rc-g4h9.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-p6pv-q7rc-g4h9 (spree_storefront): Unauthenticated Spree Commerce users
4+
can view completed guest orders by Order ID'
5+
comments: false
6+
categories:
7+
- spree_storefront
8+
advisory:
9+
gem: spree_storefront
10+
ghsa: p6pv-q7rc-g4h9
11+
url: https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9
12+
title: Unauthenticated Spree Commerce users can view completed guest orders by Order
13+
ID
14+
date: 2026-02-05
15+
description: |
16+
### Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)
17+
18+
The `OrdersController#show` action permits viewing completed
19+
guest orders by order number alone, without requiring the
20+
associated order token.
21+
22+
Order lookup without enforcing token requirement in [`OrdersController#show`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14):
23+
24+
```ruby
25+
@order = complete_order_finder.new(number: params[:id],
26+
token: params[:token], store: current_store).execute.first
27+
```
28+
29+
Authorization bypass for guest orders in [`authorize_access`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8):
30+
```ruby
31+
def authorize_access
32+
return true if @order.user_id.nil?
33+
34+
@order.user == try_spree_current_user
35+
end
36+
```
37+
38+
If the attacker is in possession of a leaked Order ID, they might
39+
look it up directly via this API.
40+
Alternatively, brute forcing all or parts of the possible
41+
Order IDs might be feasible for an attacker. (The Order IDs
42+
themselves are [securely generated](https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45),
43+
but with relatively low entropy: by default an order ID has a
44+
length of 9 and a base of 10, that would require an attacker to
45+
perform 1 billion requests to gather all guest orders. (At an
46+
assumed constant rate of 100 requests per second it would take 115 days.)
47+
48+
#### Impact
49+
50+
This issue may lead to disclosure of PII of guest users
51+
(including names, addresses and phone numbers).
52+
53+
#### CWEs
54+
55+
- CWE-639: Authorization Bypass Through User-Controlled Key
56+
57+
### Credit
58+
59+
This issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent)
60+
and manually verified by GHSL team members
61+
[@p- (Peter Stöckli)](https://github.com/p-) and
62+
[@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).
63+
64+
### Disclosure Policy
65+
66+
This report is subject to a 90-day disclosure deadline, as
67+
described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).
68+
patched_versions:
69+
- "~> 5.0.8"
70+
- "~> 5.1.10"
71+
- "~> 5.2.7"
72+
- ">= 5.3.2"
73+
related:
74+
url:
75+
- https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9
76+
- https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab
77+
- https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be
78+
- https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d
79+
- https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad
80+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14
81+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8
82+
- https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45
83+
- https://github.com/advisories/GHSA-p6pv-q7rc-g4h9
84+
notes: "- CVE-2026-25757 in GHSA advisory.\n"
85+
---

0 commit comments

Comments
 (0)