CVE-2026-25757

low-risk

Published 2026-02-06

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Spree

Affected Vendors

Spreecommerce

References (8)

Patch https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/sto...

Patch https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/cor...

Patch https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab

Patch https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be

Patch https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d

Patch https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad

Exploit https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal