Spree is an open‑source e‑commerce platform that mistakenly allowed authorized users to associate any guest cart to their own account. By exploiting the PATCH /api/v3/store/carts/:id/associate endpoint, a logged‑in customer can generate the reversible prefixed cart identifier, locate an existing guest cart, and link it to their account without possessing the guest cart token. The attacker can then retrieve billing and shipping details stored in that cart and potentially delete or overwrite the guest’s in‑progress order.

Spree’s vulnerability affects versions 5.4.0 through 5.4.4 and 5.5.4 of the Open‑Source e‑commerce software. The fix was introduced in release 5.4.4 and is also present in 5.5.4. All installations of these affected builds that expose the checkout API for guest users without login are susceptible.

The CVSS score of 7.1 indicates a high severity flaw. Because the exploit requires an authenticated user with the ability to predict or enumerate cart IDs, the attack window is limited to sites allowing guest carts with address data. The EPSS score is not available and the vulnerability has not been listed as a known exploited vulnerability by CISA, suggesting a low immediate threat vector. Nevertheless, the potential for personal data exposure and disruption of guest shopping sessions warrants timely mitigation.