CVE-2026-22589
HighSummary
Spree, an open-source e-commerce solution built with Ruby on Rails, prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, has an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability. It allows an unauthenticated attacker to access guest address information without valid credentials or session cookies.
Risk Assessment
The risk for the organization is unauthorized disclosure of customer personal data (addresses), potentially violating data protection regulations (e.g., GDPR) and harming the company's reputation.
Recommendation
Immediately update Spree to one of the patched versions: 4.10.2, 5.0.7, 5.1.9, or 5.2.5. Also, review logs for any unauthorized access to address data.
Related vulnerabilities
- CVE-2026-94084Critical
Use-after-free vulnerability in Suricata before 8.0.7 occurs in the Http2ThreadMultiBuf mechanism when a transaction is inspected by rules using http.response_header with and without a transform.
- CVE-2026-94083Critical
In Suricata before 8.0.7, a type confusion in DoH2 can cause an invalid free because cleanup code for HTTP2 state runs even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is default in 8.x versions.
- CVE-2026-93958Critical
Vulnerability in D-Link R95 (BE9500_1.00.16) affects the system function in /bin/ssi of the DHMAPI component. Manipulation of the NTPServer argument results in OS command injection. The attack can be executed remotely, and the exploit is public.
- CVE-2026-93985Critical
OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
- CVE-2026-78030Critical
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. These attributes are passed to require without checking that the value names a module, allowing loading and executing code from any file.
- CVE-2026-93742Critical
A vulnerability has been identified in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWsc function of the /boafrm/formWsc file. Manipulation of the localPin argument leads to command injection. The attack can be launched remotely, and a public exploit is already available.
- CVE-2026-86591Critical
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
- CVE-2026-93741Critical
A vulnerability has been discovered in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWlWds function of the /boafrm/formWlWds file. Manipulation of the submit-url argument results in a buffer overflow. The attack can be launched remotely, and a public exploit has already been released.
- CVE-2026-92229Critical
The Forminator Forms plugin for WordPress (versions up to and including 1.57.2) is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2026-89274Critical
The WP Recipe Maker plugin for WordPress (versions up to and including 10.8.1) is vulnerable to arbitrary shortcode execution. The sanitize_metadata() function recursively calls do_shortcode() on recipe metadata fields, including reviewBody populated from comment content, without sanitizing shortcode tokens before execution. Unauthenticated attackers can execute arbitrary registered shortcodes on every recipe page render, disclosing data in JSON-LD metadata.
Original NVD description (English source)
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.