Unauthenticated Spree Commerce users can view completed guest orders by Order ID

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 0.0049, the 42nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the GitHub Advisory Database, published 5 Feb 2026. New records show when each source confirmed them.

Sources

• GitHub Advisory Database: GHSA-p6pv-q7rc-g4h9
• OSV: GHSA-p6pv-q7rc-g4h9
• github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9
• nvd.nist.gov/vuln/detail/CVE-2026-25757
• github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab
• github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be
• github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d
• github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad
• github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_storefront/CVE-2026-25757.yml
• github.com/spree/spree
• github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14
• github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8
• github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.