Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/spree_auth@0.40.2
purl pkg:gem/spree_auth@0.40.2
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-t9gu-2vs3-g7cu
Aliases:
CVE-2013-2506
GHSA-jp57-9j37-5476
OSV-90865
Permissions, Privileges, and Access Controls app/models/spree/user.rb in spree_auth_devise in Spree does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.
3.0.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-04T20:03:31.479782+00:00 GitLab Importer Affected by VCID-t9gu-2vs3-g7cu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/spree_auth/CVE-2013-2506.yml 38.6.0