216.73.216.197

CVE-2026-25757

· Published 06/02/2026 23:15 · Modified 06/02/2026 23:15

Labels: CVE-2026-25757 2026-02-06CVE-2026-25757CWE-639[email protected]

Essential information

Published
06/02/2026 23:15
Modified
06/02/2026 23:15
Author
—
Creator
—
CVSS
7.7 HIGH (v3) 7.7 HIGH (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
spree / spree cpe:2.3:a:spree:spree:<5.0.8:*:*:*:*:*:*
spree / spree cpe:2.3:a:spree:spree:<5.1.10:*:*:*:*:*:*
spree / spree cpe:2.3:a:spree:spree:<5.2.7:*:*:*:*:*:*
spree / spree cpe:2.3:a:spree:spree:<5.3.2:*:*:*:*:*:*

References