A flaw in the Spree API allows any unauthenticated actor to read guest address information via insecure direct object references. The vulnerability is based on improper access control and falls under the CWE-639 weak authentication category. An attacker can exploit this to obtain personally identifying information about site visitors without providing credentials, which could be used for phishing or other social engineering attacks.

The vulnerability affects Spree Commerce versions earlier than 4.10.2, 5.0.7, 5.1.9, and 5.2.5. Systems running any of these releases are at risk unless upgraded to the patched versions, which are 4.10.2, 5.0.7, 5.1.9, 5.2.5 or newer releases.

The CVSS score of 7.5 places the issue in the high severity range, though the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would involve sending direct HTTP requests to the address endpoints exposed by the API, requiring no authentication or session context. The attack path is shallow and does not depend on complex prerequisites, making it easy to execute if an attacker discovers the endpoint.