Skip to content

Commit d38f091

Browse files
jasnowjasnow
committed
GHSA SYNC: 2 new advisories; 3 modified advisories
1 parent 1886fa5 commit d38f091

File tree

5 files changed

+183
-0
lines changed

5 files changed

+183
-0
lines changed

‎gems/phlex/GHSA-w67g-2h6v-vjgq.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,4 +60,5 @@ related:
6060
- https://github.com/yippee-fun/phlex/commit/74e3d8610ffabc2cf5f241945e9df4b14dceb97d
6161
- https://github.com/yippee-fun/phlex/commit/9f56ad13bea9a7d6117fdfd510446c890709eeac
6262
- https://github.com/yippee-fun/phlex/commit/fe9ea708672f9fa42526d9b47e1cdc4634860ef1
63+
- https://advisories.gitlab.com/pkg/gem/phlex/GHSA-w67g-2h6v-vjgq
6364
- https://github.com/advisories/GHSA-w67g-2h6v-vjgq

‎gems/spree_api/CVE-2026-25758.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
---
2+
gem: spree_api
3+
cve: 2026-25758
4+
ghsa: 87fh-rc96-6fr6
5+
url: https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
6+
title: Unauthenticated Spree Commerce users can access all guest addresses
7+
date: 2026-02-05
8+
description: |
9+
### Summary
10+
11+
A critical IDOR vulnerability exists in Spree Commerce's guest
12+
checkout flow that allows any guest user to bind arbitrary guest
13+
addresses to their order by manipulating address ID parameters.
14+
This enables unauthorized access to other guests' personally
15+
identifiable information (PII) including names, addresses and
16+
phone numbers. The vulnerability bypasses existing ownership
17+
validation checks and affects all guest checkout transactions.
18+
19+
### Impact
20+
21+
This issue may lead to disclosure of PII of guest users
22+
(including names, addresses and phone numbers).
23+
24+
### Unauthenticated users can access all guest addresses (`GHSL-2026-027`)
25+
26+
The vulnerability stems from incomplete authorization validation
27+
in Spree's checkout address assignment logic. While nested address
28+
attributes (`bill_address_attributes[id]` and
29+
`ship_address_attributes[id]`) are properly validated through
30+
`validate_address_ownership`, plain ID parameters (`bill_address_id`
31+
and `ship_address_id`) bypass this check entirely. Since Spree's
32+
address IDs are sequential numbers, an attacker might get all
33+
guest addresses by simply enumerating over them.
34+
35+
### Affected Code Components
36+
37+
1. **Permitted Attributes** ([`core/lib/spree/permitted_attributes.rb:92–96`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96))
38+
- Allows `bill_address_id` and `ship_address_id` as permitted
39+
parameters without validation
40+
41+
2. **Checkout Update** ([`core/app/models/spree/order/checkout.rb:241–254`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254))
42+
- Applies permitted parameters directly to the Order model
43+
via `update_from_params`
44+
45+
3. **Incomplete Ownership Validation** ([`core/app/services/spree/checkout/update.rb:33–48`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48))
46+
- `validate_address_ownership` only validates nested attributes structure
47+
- Does NOT validate plain `bill_address_id`/`ship_address_id` fields
48+
49+
4. **Vulnerable Assignment Logic** ([`core/app/models/spree/order/address_book.rb:16–23, 31–38`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38))
50+
* [`bill_address_id=` setter](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L24)
51+
* [`ship_address_id=` setter](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L31-L39)
52+
53+
Both setters check that: `address.user_id == order.user_id`. For
54+
guest orders: nil == nil → TRUE ✓ (bypass!)
55+
56+
#### Impact
57+
58+
This issue may lead to disclosure of PII of guest users
59+
(including names, addresses and phone numbers).
60+
61+
#### CWEs
62+
63+
- CWE-639: Authorization Bypass Through User-Controlled Key
64+
- CWE-284: Improper Access Control
65+
66+
### Credit
67+
68+
This issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent)
69+
and manually verified by GHSL team members
70+
[@p- (Peter Stöckli)](https://github.com/p-) and
71+
[@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).
72+
73+
### Disclosure Policy
74+
75+
This report is subject to a 90-day disclosure deadline, as
76+
described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).
77+
cvss_v4: 7.7
78+
patched_versions:
79+
- "~> 4.10.3"
80+
- "~> 5.0.8"
81+
- "~> 5.1.10"
82+
- "~> 5.2.7"
83+
- ">= 5.3.2"
84+
related:
85+
url:
86+
- https://nvd.nist.gov/vuln/detail/CVE-2026-25758
87+
- https://github.com/spree/spree/security/advisories/GHSA-87fh-rc96-6fr6
88+
- https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734
89+
- https://github.com/spree/spree/commit/29282d1565ba4f7bc2bbc47d550e2c0c6d0ae59f
90+
- https://github.com/spree/spree/commit/6650f96356faa0d16c05bcb516f1ffd5641741b8
91+
- https://github.com/spree/spree/commit/902d301ac83fd2047db1b9a3a99545162860f748
92+
- https://github.com/spree/spree/commit/ff7cfcfcfe0c40c60d03317e1d0ee361c6a6b054
93+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/address_book.rb#L16-L38
94+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254
95+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48
96+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96
97+
- https://advisories.gitlab.com/pkg/gem/spree_api/CVE-2026-25758
98+
- https://github.com/advisories/GHSA-87fh-rc96-6fr6

‎gems/spree_api/GHSA-87fh-rc96-6fr6.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ related:
9292
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/models/spree/order/checkout.rb#L241-L254
9393
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/app/services/spree/checkout/update.rb#L33-L48
9494
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/core/lib/spree/permitted_attributes.rb#L92-L96
95+
- https://advisories.gitlab.com/pkg/gem/spree_api/GHSA-87fh-rc96-6fr6
9596
- https://github.com/advisories/GHSA-87fh-rc96-6fr6
9697
notes: |
9798
- CVE-2026-25758 in GHSA Advisory.

‎gems/spree_storefront/CVE-2026-25757.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
gem: spree_storefront
3+
cve: 2026-25757
4+
ghsa: p6pv-q7rc-g4h9
5+
url: https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9
6+
title: Unauthenticated Spree Commerce users can view completed
7+
guest orders by Order ID
8+
date: 2026-02-05
9+
description: |
10+
### Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)
11+
12+
The `OrdersController#show` action permits viewing completed
13+
guest orders by order number alone, without requiring the
14+
associated order token.
15+
16+
Order lookup without enforcing token requirement in
17+
[`OrdersController#show`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14):
18+
19+
```ruby
20+
@order = complete_order_finder.new(number: params[:id],
21+
token: params[:token], store: current_store).execute.first
22+
```
23+
24+
Authorization bypass for guest orders in [`authorize_access`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8):
25+
26+
```ruby
27+
def authorize_access
28+
return true if @order.user_id.nil?
29+
30+
@order.user == try_spree_current_user
31+
end
32+
```
33+
34+
If the attacker is in possession of a leaked Order ID, they might
35+
look it up directly via this API.
36+
Alternatively, brute forcing all or parts of the possible Order IDs
37+
might be feasible for an attacker. (The Order IDs themselves are
38+
[securely generated](https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45),
39+
but with relatively low entropy: by default an order ID has a length
40+
of 9 and a base of 10, that would require an attacker to perform
41+
1 billion requests to gather all guest orders. (At an assumed
42+
constant rate of 100 requests per second it would take 115 days.)
43+
44+
#### Impact
45+
46+
This issue may lead to disclosure of PII of guest users
47+
(including names, addresses and phone numbers).
48+
49+
#### CWEs
50+
51+
- CWE-639: Authorization Bypass Through User-Controlled Key
52+
53+
### Credit
54+
55+
This issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent)
56+
and manually verified by GHSL team members
57+
[@p- (Peter Stöckli)](https://github.com/p-) and
58+
[@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).
59+
60+
### Disclosure Policy
61+
62+
This report is subject to a 90-day disclosure deadline, as
63+
described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).
64+
cvss_v4: 7.7
65+
patched_versions:
66+
- "~> 5.0.8"
67+
- "~> 5.1.10"
68+
- "~> 5.2.7"
69+
- ">= 5.3.2"
70+
related:
71+
url:
72+
- https://nvd.nist.gov/vuln/detail/CVE-2026-25757
73+
- https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9
74+
- https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab
75+
- https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be
76+
- https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d
77+
- https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad
78+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14
79+
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8
80+
- https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45
81+
- https://advisories.gitlab.com/pkg/gem/spree_storefront/CVE-2026-25757
82+
- https://github.com/advisories/GHSA-p6pv-q7rc-g4h9

‎gems/spree_storefront/GHSA-p6pv-q7rc-g4h9.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,5 +74,6 @@ related:
7474
- https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8
7575
- https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45
7676
- https://github.com/advisories/GHSA-p6pv-q7rc-g4h9
77+
- https://advisories.gitlab.com/pkg/gem/spree_storefront/GHSA-p6pv-q7rc-g4h9
7778
notes: |
7879
- CVE-2026-25757 in GHSA advisory.

0 commit comments

Comments
 (0)