Cloudanix VulnDB

GHSA-g268-72p7-9j6j

Medium · 6.5

CVSS

6.5

EPSS

—

Published

Jan 8, 2026

CISA due date

—

The record

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Affected packages

Ecosystem Package Introduced Fixed
RubyGems spree_api 3.7.0 4.10.2
RubyGems spree_api 5.0.0 5.0.7
RubyGems spree_api 5.1.0 5.1.9
RubyGems spree_api 5.2.0 5.2.5
gem spree_api 3.7.0 4.10.2
gem spree_api 5.0.0 5.0.7
gem spree_api 5.1.0 5.1.9
gem spree_api 5.2.0 5.2.5

Related vulnerabilities