Spree, an open‑source e‑commerce platform built with Ruby on Rails, contains an authenticated Insecure Direct Object Reference that lets a user alter their own order and replace the address identifiers in the request with those belonging to another user. The backend accepts the foreign identifiers, associates the other user’s addresses with the requester’s order, and returns them in the response, exposing private address details. This flaw is a CWE‑639 type of vulnerability that compromises confidentiality of personal data.

The issue affects Spree versions earlier than 4.10.2, 5.0.7, 5.1.9, and 5.2.5. Any deployment using those releases and allowing authenticated users to create or modify orders is potentially impacted. The solution is available in the released patches for each of those specific major releases.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, reducing immediate threat. Exploitation requires valid user authentication and the ability to modify an order; no additional privileges are required. Once the attack is carried out, the attacker receives sensitive delivery address data that could be used for identity theft or targeted fraud.