Unauthenticated users can retrieve any completed guest order by providing its Order ID to the Spree Orders controller. The vulnerability arises because the controller does not enforce authentication or access checks for these orders, allowing disclosure of personally identifiable information such as names, addresses, and phone numbers. The weakness corresponds to CWE-639, Information Exposure from Public Endpoints. The likely attack vector is an HTTP request to the order endpoint, which the controller currently serves without requiring login or permission checks.

Spree Commerce versions prior to 5.0.8, 5.1.10, 5.2.7, and 5.3.2 expose this flaw. Those releases allow any user to view guest order details because the Orders controller and number generator lack proper authorization safeguards.

The CVSS score of 7.7 signals high confidentiality impact, while the EPSS score of <1% indicates a low probability of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog, implying no large‑scale exploitation campaigns are known. Nevertheless, the flaw can be exploited trivially by guessing or enumerating order identifiers, potentially exposing dozens or hundreds of guest orders to unauthenticated parties.