Executive brief
Spree's Store API contains an access control flaw in its cart association endpoint that allows authenticated customers to view checkout addresses from guest shopping carts they don't own. An attacker can enumerate cart IDs and retrieve PII including names, addresses, and phone numbers from abandoned guest checkouts, as well as disrupt ongoing transactions by taking over the carts. This affects any Spree store not configured for login-required mode.
Technical details
The PATCH /api/v3/store/carts/:id/associate endpoint lacks the authorization check that other cart endpoints enforce via CartResolvable. It relies solely on a reversible Sqids encoding (obfuscation, not cryptographic) for the cart prefix ID, allowing any authenticated user to derive candidate IDs offline and access arbitrary guest carts. The endpoint finds carts via `current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])` without verifying cart possession via token, then reassigns ownership and returns the billing/shipping address (including name, street, postal code, phone). The vulnerability requires an authenticated account but no special privileges, and is triggered by PATCH requests to a guessable ID with valid user context.
Affected products
- Spree Spree before 5.4.4 and before 5.5.4
Timeline
- 2026-09-22: disclosed
- 2026-09-22: other: CVE-2026-94462 assigned