Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/spree_core@5.2.0.rc1
purl pkg:gem/spree_core@5.2.0.rc1
Next non-vulnerable version 5.2.5
Latest non-vulnerable version 5.2.5
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-1373-hmyc-sqbx
Aliases:
CVE-2026-22589
GHSA-3ghg-3787-w2xr
Spree API has Unauthenticated IDOR - Guest Address An Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies.
5.2.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-1373-hmyc-sqbx Spree API has Unauthenticated IDOR - Guest Address An Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. CVE-2026-22589
GHSA-3ghg-3787-w2xr

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-31T10:20:35.557849+00:00 Ruby Importer Fixing VCID-1373-hmyc-sqbx https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml 38.6.0
2026-05-31T10:20:34.621144+00:00 Ruby Importer Affected by VCID-1373-hmyc-sqbx https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml 38.6.0