An IDOR flaw in Spree Commerce’s guest checkout flow lets unauthenticated users bind arbitrary guest addresses to their order by tampering with address‑ID parameters. This bypasses ownership validation checks, exposing personally identifiable information such as names, addresses, and phone numbers of other guests.

The vulnerability affects all Spree Commerce installations running a version older than 4.10.3, 5.0.8, 5.1.10, 5.2.7, or 5.3.2. Because Spree is an open‑source e‑commerce platform built on Ruby on Rails, the flaw is present in every derived instance that has not applied the patch.

With a CVSS score of 7.7, the flaw is classified as high severity, but the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, signifying a low exploitation probability under current conditions. Likely exploitation requires only a simple URL manipulation by an unauthenticated guest user, making the attack vector straightforward and requiring no privileged access. Nevertheless, any attacker can obtain another guest’s PII, posing privacy and compliance risks.