CVE-2026-94462: Spree E-Commerce Auth Bypass Vulnerability

CVE-2026-94462 Overview

CVE-2026-94462 is an Insecure Direct Object Reference (IDOR) vulnerability in Spree, an open source e-commerce platform built with Ruby on Rails. The flaw resides in the PATCH /api/v3/store/carts/:id/associate endpoint handled by Spree::Api::V3::Store::CartsController#associate. The endpoint uses find_cart_for_association to locate a cart by its prefixed ID but does not require a cart token to prove possession. An authenticated customer can derive reversible prefixed cart IDs, associate a victim's guest cart with their own account, and read the billing and shipping addresses attached to that cart. The issue affects Spree versions 5.4.0 through 5.4.3 and 5.5.0 through 5.5.3, and is fixed in 5.4.4 and 5.5.4.

Critical Impact
An authenticated attacker can hijack guest carts on stores that do not require login for checkout, exposing billing and shipping address data and disrupting the victim's in-progress checkout.

Affected Products

Spree Commerce 5.4.0 through 5.4.3
Spree Commerce 5.5.0 through 5.5.3
Deployments where guest checkout is enabled and guest carts contain address data

Discovery Timeline

2026-09-22 - CVE-2026-94462 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94462

Vulnerability Analysis

The associate action in Spree::Api::V3::Store::CartsController is designed to link a guest cart to the currently authenticated user. Before the fix, the controller required only JWT authentication and a cart ID in the request URL. It did not validate the x-spree-token cart token that normally proves possession of a guest cart. Because Spree cart identifiers are prefixed and reversible, an authenticated customer can enumerate or derive valid cart IDs belonging to other guests. Submitting a derived ID to the associate endpoint reassigns the target guest cart to the attacker's account and returns the cart contents, including billing and shipping addresses. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Root Cause

The root cause is missing authorization on a state-changing API endpoint. The controller trusted the cart ID as a sufficient reference and skipped the cart-token check that authorizes claiming a cart. This is a classic IDOR: the object reference (prefixed_id) is derivable and no possession credential is verified before the association service is called.

Attack Vector

Exploitation requires an authenticated account on a Spree store that permits guest checkout. The attacker derives a valid prefixed_id for a guest cart that already contains an address, then issues a PATCH /api/v3/store/carts/:id/associate request with their JWT. The server reassigns the cart to the attacker and returns the address data. The reassignment also detaches the cart from the original guest, disrupting their checkout.

ruby

           end
 
           # PATCH /api/v3/store/carts/:id/associate
-          # Associates a guest cart with the currently authenticated user
-          # Requires: JWT authentication + cart ID in URL
+          # Associates a guest cart with the currently authenticated user.
+          # Requires: JWT authentication + cart ID in URL + possession of the
+          # cart's token (x-spree-token). The token is the credential that
+          # authorizes claiming the cart, so it is required even when the cart
+          # is already the caller's own.
           def associate
             @cart = find_cart_for_association
+            authorize!(:update, @cart, cart_token)
+            require_cart_token!
 
             result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)

Source: Spree commit 8834230. The patch adds authorize!(:update, @cart, cart_token) and require_cart_token! so the caller must present the cart's token before the associate service runs.

Detection Methods for CVE-2026-94462

Indicators of Compromise

Successful PATCH /api/v3/store/carts/:id/associate requests where the requesting user is not the original owner of the cart
Bursts of PATCH /api/v3/store/carts/:id/associate requests from a single JWT enumerating varying prefixed_id values
Guest checkout sessions that suddenly lose their cart or report a missing order mid-flow
Order records whose user_id transitions from null to an authenticated user without a matching login-time association event

Detection Strategies

Parse Rails and reverse-proxy logs for repeated calls to carts/:id/associate from the same authenticated identity with different cart IDs.
Correlate cart ownership changes with the original cart token to flag associations that were completed without a matching x-spree-token header.
Alert on any 2xx response to the associate endpoint on Spree instances running 5.4.0–5.4.3 or 5.5.0–5.5.3 prior to patching.

Monitoring Recommendations

Enable verbose request logging on /api/v3/store/carts/* and forward events to a centralized analytics pipeline.
Track per-JWT rate limits on the associate endpoint and trigger review when a single account claims multiple guest carts.
Monitor customer support tickets referencing lost guest carts or unexpected address changes as a behavioral signal.

How to Mitigate CVE-2026-94462

Immediate Actions Required

Upgrade Spree to 5.4.4 on the 5.4.x branch or 5.5.4 on the 5.5.x branch.
Audit spree_orders for records where user_id was updated after cart creation without an accompanying legitimate login-based association.
Rotate active guest cart tokens and force re-authentication for API clients after upgrading.

Patch Information

The fix was delivered through Spree Pull Request #14314 and shipped in Spree Release v5.4.4 and Spree Release v5.5.4. The patch commits are 8834230a and af0d1a2d. Full advisory details are available in GitHub Security Advisory GHSA-4825-p4xm-pcf2.

Workarounds

If patching must be delayed, disable guest checkout so guest carts do not accumulate address data eligible for theft.
Place a web application firewall (WAF) rule in front of PATCH /api/v3/store/carts/:id/associate that requires the x-spree-token header on every request.
Restrict access to the Store API from untrusted networks or apply per-account rate limits to slow enumeration of prefixed cart IDs.

bash

# Example WAF rule (pseudo-config) to require the cart token header
location ~ ^/api/v3/store/carts/[^/]+/associate$ {
    if ($request_method = PATCH) {
        if ($http_x_spree_token = "") { return 401; }
    }
    proxy_pass http://spree_upstream;
}