CVE-2020-15269

Name of the Vulnerable Software and Affected Versions Spree versions prior to 3.7.11 Spree versions prior to 4.0.4 Spree versions prior to 4.1.11

Description The issue allows expired user tokens to be used for accessing Storefront API v2 endpoints. This could be exploited by a perpetrator who previously obtained an old expired user token.

Recommendations For versions prior to 3.7.11, upgrade to version 3.7.11. For versions prior to 4.0.4, upgrade to version 4.0.4. For versions prior to 4.1.11, upgrade to version 4.1.11. As a temporary workaround without upgrading, create a decorator file app/controllers/spree/api/v2/base controller decorator.rb with the specified contents to override the spree current user method in Spree::Api::V2::BaseController.