2 known security vulnerabilities

  • highGHSA-87fh-rc96-6fr6(CVE-2026-25758)

    Unauthenticated Spree Commerce users can access all guest addresses

Show 1 more vulnerability
1 moderate
  • moderateGHSA-g268-72p7-9j6j(CVE-2026-22588)

    Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Spree's API

Required Ruby Version

>= 2.5.0

Authors

Ryan Bigg

Versions

  1. 6.0.2

    1. source

      1. 6.0.2 source November 02, 2026 (818 KB)
  2. 6.0.1

    1. source

      1. 6.0.1 source October 29, 2026 (493 KB)
  3. 6.0.0

    1. source

      1. 6.0.0 source October 27, 2026 (492 KB)
  4. 6.0.0.rc7

    1. source

      1. 6.0.0.rc7 source October 26, 2026 (488 KB)
  5. 6.0.0.rc6

    1. source

      1. 6.0.0.rc6 source October 26, 2026 (488 KB)
  6. 4.2.3

    1. source

      1. 4.2.3 source May 05, 2021 (83.5 KB)
Show all versions (426 total)

SHA 256 checksum

← Previous version Next version →