High
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
Type: advisorySources: OSV
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-25757
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:03 UTC · Revision 1
Source evidence
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
core-osv · Original sourcePublished 6 Feb 2026, 22:37 UTC
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
osv:CVE-2026-25757
Complete source record
{
"id": "02384a0fa1898f25413eeeb2800d1aad0f26e39602b18963866bc0e7f6d48de9",
"url": "https://osv.dev/vulnerability/CVE-2026-25757",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Unauthenticated Spree Commerce users can view completed guest orders by Order ID",
"summary": "Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.",
"evidence": "osv:CVE-2026-25757",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-25757",
"aliases": [
"CVE-2026-25757",
"GHSA-p6pv-q7rc-g4h9"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/spree/spree",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "7af62b211e1750d272887b258b27c736586abe5e"
},
{
"introduced": "a8d7ad128ce7adabaea7e254803ac836fe88e154"
},
{
"fixed": "df01ae37e70d261babc8675e4882e2ee61067f6b"
},
{
"introduced": "a100d2b1c9b264d1796b2433db002d12dddc32cc"
},
{
"fixed": "9b993497af028b28f5f08e11fcc65676702f4b98"
},
{
"introduced": "598f2be5f586d4b802874ec71bfd8ffe46851a4b"
},
{
"fixed": "506a52f48f767b75bc2e5465f99b2c138074520b"
},
{
"fixed": "3e00be64c128ef4bd4b99731f0c3ab469509cfab"
},
{
"fixed": "6b32ed7d474aa55fa441990e6aa39740152aa1be"
},
{
"fixed": "6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d"
},
{
"fixed": "ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.0.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.1.0"
},
{
"fixed": "5.1.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "3e00be64c128ef4bd4b99731f0c3ab469509cfab"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "6b32ed7d474aa55fa441990e6aa39740152aa1be"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v5.0.7",
"v5.1.9",
"v5.2.6",
"v5.3.1",
"v5.3.0",
"v5.2.5",
"v5.0.6",
"v5.1.8",
"v5.2.4",
"v4.10.1",
"v5.2.3",
"v5.2.2",
"v5.2.1",
"v5.2.0",
"v5.1.7",
"v5.1.6",
"v5.1.5",
"v5.1.4",
"v5.0.5",
"v5.1.3",
"v5.1.2",
"v5.1.1",
"v5.1.0",
"v5.0.4",
"v5.0.3",
"v5.0.2",
"v5.0.1",
"v5.0.0",
"v4.10.0",
"v4.9.0",
"v4.8.3",
"v4.8.2",
"v4.8.1",
"v4.8.0",
"v4.7.0",
"v4.6.0",
"v4.5.0",
"v4.4.0.rc1",
"v4.3.0",
"v4.3.0.rc3",
"v4.3.0.rc2",
"v4.3.0.rc1",
"v4.2.0",
"v4.2.0.rc5",
"v4.2.0.rc4",
"v4.2.0.rc3",
"v4.2.0.rc2",
"v4.2.0.rc1",
"v4.2.0.beta",
"v4.1.0",
"v4.1.0.rc3",
"v4.1.0.rc2",
"v4.1.0.rc1",
"v4.0.0.beta",
"v3.7.0.rc1",
"v3.7.0.beta",
"v3.6.0.rc1",
"v3.5.0.rc1",
"v3.4.0",
"v3.4.0.rc2",
"v3.4.0.rc1",
"v3.3.0",
"v3.3.0.rc4",
"v3.3.0.rc3",
"v3.2.2",
"v3.3.0.rc2",
"v3.3.0.rc1",
"v3.2.0.rc1",
"v3.1.0.rc1",
"v3.0.0.rc1",
"v2.4.0.rc2",
"v2.4.0.rc1",
"v1.2.0.rc1",
"v1.0.0.rc3",
"v1.0.0.rc2",
"v1.0.0.rc1",
"v0.70.0.rc2",
"v0.40.0",
"v0.11.99",
"v0.30.0.beta1",
"v0.11.0",
"v0.8.2",
"v0.4.0",
"v0.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25757.json"
}
}
],
"modified": "2026-10-28T02:30:37.823969995Z",
"provider": "osv",
"references": [
"https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14",
"https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8",
"https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25757.json",
"https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9",
"https://nvd.nist.gov/vuln/detail/CVE-2026-25757",
"https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab",
"https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be",
"https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d",
"https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad"
],
"provider_metadata": {
"cwe_ids": [
"CWE-639"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25757.json"
}
},
"related_cves": [
{
"value": "CVE-2026-25757",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505112,
"published_at": "2026-02-06T22:37:07.542+00:00"
}