CVE-2020-26223 json
Authorization bypass in Spree
published 5y ago modified last mo. also GHSA-m2jr-hmc3-qmpr , EUVD-2020-1461
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.
Patch / fix
- rubygems spree_api 3.7.13, 4.0.5, 4.1.12
- spreecommerce spree 3.7.13, 4.0.5, 4.1.12
- github.com/spree/spree#10573 pull request
Is CVE-2020-26223 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/spree/spree/pull/10573 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | spree_api | >=3.7.0, <3.7.13 >=4.0.0, <4.0.5 >=4.1.0, <4.1.12 |
3.7.13 4.0.5 4.1.12 |
Affected products
- spree spree
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/spree/spree/pull/10573
web, exploit, patch, third-party-advisory
-
guides.spreecommerce.org
/api/v2/storefront#tag/Order-Status
web, vendor-advisory
-
github.com
/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-26223
advisory
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2020-26223.yml
web
-
github.com
/spree/spree
package
-
rubygems.org
/gems/spree_api/versions
web
Sources
- CVE List CVE-2020-26223
- GitHub Advisory GHSA-m2jr-hmc3-qmpr
- NVD CVE-2020-26223
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.