# CVE-2026-94462: Spree Store API broken access control in cart association

Source: https://junglewise.ai/threats/cve-2026-94462-spree-store-api-broken-access-control-in-cart-association  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-94462 · Severity: high · CVSS 7.1 · Published 2026-09-22

Spree's Store API contains an access control flaw in its cart association endpoint that allows authenticated customers to view checkout addresses from guest shopping carts they don't own. An attacker can enumerate cart IDs and retrieve PII including names, addresses, and phone numbers from abandoned guest checkouts, as well as disrupt ongoing transactions by taking over the carts. This affects any Spree store not configured for login-required mode.

Technologies: [spree_api (RubyGems)](https://junglewise.ai/threats/technologies/spree-api). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-94462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94462 being exploited in the wild.

**How severe is CVE-2026-94462?** High severity, with a CVSS score of 7.1, published 22 September 2026.

**Which products and versions are affected?** spree_api (RubyGems) ECOSYSTEM:introduced=5.4.0,fixed=5.4.4.

**Is there a fix for CVE-2026-94462?** Yes. spree_api (RubyGems): upgrade to 5.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94462 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94462?** Check whether you run spree_api (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- spree_api (RubyGems): upgrade to 5.4.4 or later

  ```sh
  bundle update spree_api
  ```


## Technical details

The PATCH /api/v3/store/carts/:id/associate endpoint lacks the authorization check that other cart endpoints enforce via CartResolvable. It relies solely on a reversible Sqids encoding (obfuscation, not cryptographic) for the cart prefix ID, allowing any authenticated user to derive candidate IDs offline and access arbitrary guest carts. The endpoint finds carts via `current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])` without verifying cart possession via token, then reassigns ownership and returns the billing/shipping address (including name, street, postal code, phone). The vulnerability requires an authenticated account but no special privileges, and is triggered by PATCH requests to a guessable ID with valid user context.

## Affected products

- Spree Spree before 5.4.4 and before 5.5.4

## Identifiers

- CVE-2026-94462
- GHSA-4825-p4xm-pcf2

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: other: CVE-2026-94462 assigned

## Related threats

- [Unauthenticated Spree Commerce users can access all guest addresses](https://junglewise.ai/threats/cve-2026-25758-unauthenticated-spree-commerce-users-can-access-all-guest)
- [Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification](https://junglewise.ai/threats/cve-2026-22588-spree-api-has-authenticated-insecure-direct-object-reference-idor)
- [Authorization bypass in Spree](https://junglewise.ai/threats/cve-2020-26223-authorization-bypass-in-spree)