2 known security vulnerabilities

  • highGHSA-87fh-rc96-6fr6(CVE-2026-25758)

    Unauthenticated Spree Commerce users can access all guest addresses

Show 1 more vulnerability
1 moderate
  • moderateGHSA-g268-72p7-9j6j(CVE-2026-22588)

    Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Spree's API

Required Ruby Version

>= 2.5.0

Authors

Ryan Bigg

Versions

  1. 6.0.0.rc3

    1. source

      1. 6.0.0.rc3 source October 13, 2026 (442 KB)
  2. 6.0.0.rc2

    1. source

      1. 6.0.0.rc2 source October 13, 2026 (442 KB)
  3. 6.0.0.rc1

    1. source

      1. 6.0.0.rc1 source October 08, 2026 (385 KB)
  4. 6.0.0.beta4

    1. source

      1. 6.0.0.beta4 source September 24, 2026 (367 KB)
  5. 6.0.0.beta3

    1. source

      1. 6.0.0.beta3 source September 24, 2026 (367 KB)
  6. 4.2.3

    1. source

      1. 4.2.3 source May 05, 2021 (83.5 KB)
Show all versions (419 total)

SHA 256 checksum

← Previous version Next version →