CVE-2020-26223 - CVE House
Back to Database
Status published High CVE-2020-26223

Authorization bypass in Spree

Vulnerability Description

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26223

Credits & Attribution

No credits recorded in the NVD database.

References

More from spree

View All →
CVE-2021-41275
Authentication Bypass by CSRF Weakness
Critical 9.3
CVE-2020-15269
Expired token reuse in Spree
High 7.4

Affected Vendor

Affected Software

spree
Vulnerable Versions:
>= 3.7.0, < 3.7.13, >= 4.0.0, < 4.0.5, >= 4.1.0, < 4.1.12

Timeline

Official Publish: November 13th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion