CVE-2020-26223

Name of the Vulnerable Software and Affected Versions Spree versions prior to 3.7.11 Spree versions 3.7.11 through 3.7.12 are not affected, but versions prior to 3.7.11 are. However, considering the broader range, we can simplify to: Spree versions prior to 3.7.11 Spree versions 4.0.0 through 4.0.3 Spree versions 4.1.0 through 4.1.10

Description The issue concerns an authorization bypass vulnerability in Spree, a complete open source e-commerce solution built with Ruby on Rails. A perpetrator could query the "API v2 Order Status" endpoint with an empty string passed as an Order token.

Recommendations For Spree versions prior to 3.7.11, upgrade to version 3.7.11. For Spree versions 4.0.0 through 4.0.3, upgrade to version 4.0.4. For Spree versions 4.1.0 through 4.1.10, upgrade to version 4.1.11.