CVE-2026-94462: CVE-2026-94462: Broken Access Control in Spree Store API v3 Cart Association

#security #cve #cybersecurity

CVE-2026-94462: Broken Access Control in Spree Store API v3 Cart Association

Vulnerability ID: CVE-2026-94462
CVSS Score: 7.1
Published: 2026-09-22

An Insecure Direct Object Reference (IDOR) vulnerability exists in Spree open-source e-commerce solution versions 5.4.0 through 5.4.3 and 5.5.0 through 5.5.3. An authenticated attacker can predict or enumerate guest cart identifiers generated via Sqids and associate them with their own account. This unauthorized association leaks sensitive customer personally identifiable information (PII) and disrupts the checkout flow of active guest sessions.

TL;DR

Authenticated attackers can hijack arbitrary guest carts and leak customer PII by exploiting guessable cart IDs and a lack of token verification in the Spree Store API cart association endpoint.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-639
Attack Vector: Network
CVSS Score: 7.1
EPSS Score: N/A
Impact: Confidentiality (High), Integrity (Low)
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

Spree >= 5.4.0, < 5.4.4
Spree >= 5.5.0, < 5.5.4
Spree: >= 5.4.0, < 5.4.4 (Fixed in: 5.4.4)
Spree: >= 5.5.0, < 5.5.4 (Fixed in: 5.5.4)

Code Analysis

Commit: 8834230

Fix insecure direct object reference in cart association

Commit: af0d1a2

Enforce x-spree-token validation during cart association

Mitigation Strategies

Upgrade Spree to patched versions (5.4.4 or 5.5.4)
Implement Web Application Firewall (WAF) rules to block cart association requests lacking the x-spree-token header
Monitor API logs for anomalous cart association requests from single accounts

Remediation Steps:

Identify the currently deployed Spree version in the Gemfile.
Update the spree dependency to version 5.4.4 (for 5.4.x installs) or 5.5.4 (for 5.5.x installs).
Run 'bundle update spree' to apply the patch.
Deploy the updated application to production environments.

References

Read the full report for CVE-2026-94462 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community