Spree Commerce CVE-2026-94462

Requires an authenticated store customer account (JWT) - PR:L, not unauthenticated. Exploitation further requires that the target store allows checkout without login (guest checkout enabled) AND that an eligible guest cart containing billing/shipping address data exists. The vulnerable endpoint is PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate, which located carts by prefixed_id without requiring the cart's x-spree-token or any proof of possession; because prefixed cart IDs are reversible/derivable, an attacker can enumerate valid guest cart IDs. Limiting factors: only affects Spree 5.4.0 through 5.4.4 and 5.5.4, stores that mandate login for checkout are not exploitable, and the fix now mandates the matching cart token even for the caller's own cart.

This is a genuine but moderate-priority authorization flaw (IDOR / CWE-639), not an overinflated high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1) is well-supported by the description and the PR diff: exploitation is network-based and low-complexity, but it requires PR:L - an authenticated store customer account - so it is not remote-unauthenticated. The C:H rating is justified because the attacker exfiltrates a victim's billing and shipping address PII; I:L reflects that reassigning the cart can disrupt the guest's in-progress checkout but does not broadly modify data; A:N is correct. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or automated exploitation - the real-world urgency is driven by the ease of the technique (reversible prefixed cart IDs are enumerable/derivable) rather than by observed attacks. The single significant gating condition (store must allow guest checkout without login AND a guest cart with address data must exist) meaningfully narrows the exploitable population. Net: patch on a normal cadence; it is a real PII-disclosure bug but shows no signals of widespread or active exploitation.

An attacker registers a normal customer account on a Spree store that permits guest checkout, then derives the reversible prefixed_id of an eligible guest cart and sends PATCH /api/v3/store/carts/:id/associate with only their JWT - no cart token. The endpoint reassigns the guest cart to the attacker's account and returns the victim's billing and shipping addresses, while also disrupting the guest's in-progress cart. No public exploit code was identified, but the fix diff and reversible-ID design make the technique straightforward to reproduce.