---
id: CVE-2026-94462
title: Spree is an open source e-commerce solution built with Ruby on Rails
summary: >-
  Spree is an open source e-commerce solution built with Ruby on Rails. From
  5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in
  Spree::Api::V3::Store::CartsController#associate uses
  find_cart_for_association to locate …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-639
vendor: spree_api
product: spree_api
affected:
  - 'spree_api >= 5.4.0, < 5.4.4'
  - 'spree_api >= 5.5.0, < 5.5.4'
patched:
  - spree_api 5.4.4
  - spree_api 5.5.4
published: '2026-09-22'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94462'
references:
  - url: >-
      https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd
    label: security-advisories@github.com
  - url: >-
      https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8
    label: security-advisories@github.com
  - url: 'https://github.com/spree/spree/pull/14314'
    label: security-advisories@github.com
  - url: 'https://github.com/spree/spree/releases/tag/v5.4.4'
    label: security-advisories@github.com
  - url: 'https://github.com/spree/spree/releases/tag/v5.5.4'
    label: security-advisories@github.com
  - url: 'https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2'
    label: security-advisories@github.com
  - url: 'https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-4825-p4xm-pcf2'
tags:
  - nvd
  - ghsa
  - rubygems
  - cve.org
  - exploit-available
epss: 0.0028
epssPercentile: 0.18134
aliases:
  - GHSA-4825-p4xm-pcf2
ecosystem: rubygems
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T19:20:02.955046Z'
ingestedAt: '2026-09-22T19:09:09.992Z'
---

## Overview

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-94462)

Affected packages:

- `spree_api >= 5.4.0, < 5.4.4`
- `spree_api >= 5.5.0, < 5.5.4`

Patched in:

- `spree_api 5.4.4`
- `spree_api 5.5.4`

Source: https://github.com/advisories/GHSA-4825-p4xm-pcf2