Security readout for executives and security teams
Plain-English summary
CVE-2026-22589 affects Spree e-commerce sites. A flaw in the API can let an unauthenticated person view guest customer address information without logging in. This is primarily a confidentiality issue involving potentially sensitive customer data. Patched Spree versions are available.
Executive priority
Treat as a high-priority customer data exposure risk. It does not indicate system takeover, but unauthorized address disclosure can create privacy, trust, and regulatory concerns. Patch affected Spree stores promptly, especially production systems processing guest orders.
Technical view
Spree before 4.10.2, 5.0.7, 5.1.9, and 5.2.5 has an unauthenticated IDOR affecting guest address access. The CVSS 3.1 score is 7.5, with network attack vector, low complexity, no privileges, no user interaction, and high confidentiality impact. CWE-639 is listed.
Likely exposure
Internet-facing Spree storefronts or APIs running affected versions are the main exposure. The issue concerns guest address information, so stores allowing guest checkout may have higher business impact. Confirm whether Spree is deployed directly or embedded in a customized Rails commerce stack.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not marked KEV. The vulnerability is unauthenticated and network-accessible, which lowers the barrier for abuse. Public advisory and patch commits exist, so defenders should assume attackers can analyze the fix.
Researcher notes
Evidence comes from the CVE record and GitHub advisory. Sources identify affected version ranges and patched releases but do not provide exploit telemetry. Review the linked commits for code-level remediation context without relying on them as a substitute for upgrading.
Mitigation direction
- Upgrade Spree to 4.10.2, 5.0.7, 5.1.9, 5.2.5, or later as applicable.
- Prioritize internet-facing Spree stores and environments handling guest checkout data.
- Review vendor advisory and release guidance before applying updates.
- If immediate upgrade is delayed, restrict unnecessary public API exposure where operationally feasible.
Validation and detection
- Inventory all Spree applications and confirm deployed version branches.
- Check dependency manifests and running application metadata for affected Spree versions.
- Confirm the patched version is deployed in production after change completion.
- Review access logs for unusual unauthenticated requests to guest address-related API paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22589 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xrCVE reference · x_refsource_CONFIRM
- https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795CVE reference · x_refsource_MISC
- https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3adCVE reference · x_refsource_MISC
- https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67CVE reference · x_refsource_MISC
- https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6adCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.