2 known security vulnerabilities

  • highGHSA-87fh-rc96-6fr6(CVE-2026-25758)

    Unauthenticated Spree Commerce users can access all guest addresses

Show 1 more vulnerability
1 moderate
  • moderateGHSA-g268-72p7-9j6j(CVE-2026-22588)

    Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Spree's API

Required Ruby Version

>= 2.5.0

Authors

Ryan Bigg

Versions

  1. 6.0.1

    1. source

      1. 6.0.1 source October 29, 2026 (493 KB)
  2. 6.0.0

    1. source

      1. 6.0.0 source October 27, 2026 (492 KB)
  3. 6.0.0.rc7

    1. source

      1. 6.0.0.rc7 source October 26, 2026 (488 KB)
  4. 6.0.0.rc6

    1. source

      1. 6.0.0.rc6 source October 26, 2026 (488 KB)
  5. 6.0.0.rc5

    1. source

      1. 6.0.0.rc5 source October 22, 2026 (481 KB)
  6. 4.2.3

    1. source

      1. 4.2.3 source May 05, 2021 (83.5 KB)
Show all versions (425 total)

SHA 256 checksum

← Previous version Next version →