CVE-2026-94462

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94462
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94462.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-94462
Aliases
Published
2026-09-22T18:57:03Z
Modified
2026-09-23T03:47:49Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
Details

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94462.json"
}
References

Affected packages

Git / github.com/spree/spree

Affected ranges

Type
GIT
Repo
https://github.com/spree/spree
Events
Introduced
d0f1af44c1c3b67a15b9997a6428052da0e47676
Fixed
6859b1c31595a44f35d33b17907da919e2214429
Introduced
46c1d7416249256753788c011d890eae5b1fd0a9
Fixed
b1d20afe79c84fc3e248808200bef29c7ddf6ad8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "5.4.0"
        },
        {
            "fixed":  "5.4.4"
        },
        {
            "introduced":  "5.5.0"
        },
        {
            "fixed":  "5.5.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

@spree/sdk@1.*
@spree/sdk@1.0.0
@spree/sdk@1.0.1
v5.*
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.5.0
v5.5.1
v5.5.2
v5.5.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94462.json"