CVE-2026-94462

Executive Summary

CVE-2026-94462 is an authorization bypass (CWE-639, Insecure Direct Object Reference / IDOR) in Spree, an open-source Ruby on Rails e-commerce platform. The associate endpoint of the Store API v3 carts controller locates a guest cart by its reversible prefixed_id without requiring a cart token or otherwise verifying possession of that cart. Any authenticated customer can therefore reassociate an eligible guest cart to their own account and extract the guest's billing and shipping address data. The issue affects Spree versions from 5.4.0 through 5.4.3 and 5.5.0 through 5.5.3, and is fixed in 5.4.4 and 5.5.4; CVSS v3.1 base score is 7.1 (High).

Technical Analysis

Spree is an open-source e-commerce solution built with Ruby on Rails. The affected code path is the associate action of Spree::Api::V3::Store::CartsController, exposed at PATCH /api/v3/store/carts/:id/associate. According to the NVD description, this action uses a helper named find_cart_for_association to locate a cart by its prefixed_id but does not require a cart token or otherwise verify that the requester possesses the selected guest cart.

Two design properties combine to create the vulnerability:

1. Reversible cart identifiers. The prefixed_id used to reference carts is described as being derivable (reversible). That means the identifier space is not an unguessable capability but a transformable value, allowing an authenticated attacker to enumerate or compute valid guest cart identifiers rather than relying on brute force.
2. Missing possession check. The associate operation — which logically binds a cart to a user account — performs the lookup but omits the ownership verification (cart token, session binding, or equivalent) that would normally prove the caller controls the guest cart.

The result is a classic IDOR / authorization-bypass (CWE-639) condition: an operation gated only by authentication (any customer account) but not by object-level authorization over the target cart. Because the cart object holds billing and shipping address data, associating a victim's cart transfers that personal data to the attacker's account view.

Preconditions, as stated in the advisory: the targeted store must not require login for checkout (so guest carts with populated address data exist), and there must exist an eligible guest cart carrying address data. The attacker must hold a valid authenticated customer account. No user interaction from the victim is required (UI:N), and the attack is network-reachable (AV:N) with low complexity (AC:L).

The vulnerability class is well understood; the specific exploitation mechanics for this instance are constrained by the limited implementation detail in the source data. No public proof-of-concept, exploit code, or Nuclei template is known.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class and the advisory text.

1. Reconnaissance / target identification. The attacker identifies a Spree storefront running an affected version (5.4.0–5.4.3 or 5.5.0–5.5.3) that permits guest checkout (login not required). Guest carts with address data are the target objects.

2. Triggering the flaw class. The attacker obtains or computes a guest cart's prefixed_id. Because the advisory states the prefixed_id is reversible, the attacker can derive valid identifiers rather than brute-forcing them. This is the enumeration/derivation step for the IDOR.

3. Execution method (vulnerability-class level). The attacker, authenticated as a normal customer, issues PATCH /api/v3/store/carts/:id/associate with the targeted cart identifier. The find_cart_for_association helper resolves the cart by prefixed_id, and — absent any cart token or possession check — the association succeeds. No victim interaction is required.

4. Post-exploitation impact. The guest cart is reassociated to the attacker's account, exposing the stored billing and shipping address data. The success also disrupts the legitimate guest's in-progress session, because their cart is no longer bound to them. Because the operation is repeatable, an attacker with a valid account could iterate over derived identifiers to harvest address data from multiple guest carts, depending on how the reversible identifier space can be enumerated.

Impact Assessment

Per CVSS v3.1 (7.1, High): Confidentiality is rated High (C:H) — the address data (names, street addresses, possibly phone/email fields associated with billing/shipping) becomes readable to the attacker. Integrity is Low (I:L) — the cart association is modified, disrupting the guest's shopping session and enabling reassignment. Availability is Not impacted (A:N) in the CVSS sense, though the guest's cart state is broken. Attack Vector is Network (AV:N), Complexity Low (AC:L), Privileges Required Low (PR:L — any authenticated customer), User Interaction None (UI:N), Scope Unchanged (S:U).

Business impact: exposure of customer personally identifiable information (PII) in the form of shipping and billing addresses — a privacy and, in many jurisdictions, a regulatory concern (e.g., GDPR, CCPA) given the PII nature of the data. Secondary impact is customer trust and cart/session integrity: guests may find their in-progress carts hijacked or altered. Blast radius is bounded by (a) stores running affected versions and (b) the presence of guest carts containing address data, but it is repeatable per-cart and does not require the victim to be online at exploitation time. Because exploitation needs only a valid low-privilege account, an attacker can scale the attack across many carts and — where multiple stores run the affected Spree version — across multiple storefronts.

CISA KEV: not listed. EPSS: not yet scored by FIRST.org. No known in-the-wild exploitation or threat-actor campaign is documented in the provided data.

Detection Guidance

Sigma Rule

title: Spree Store API Cart Association Access (CVE-2026-94462)
id: 3f9c1a2e-6b21-4f4a-9d77-1c2b7a8e0f11
status: experimental
description: Detects PATCH requests to the Spree Store API v3 cart associate endpoint, which is abused to reassociate guest carts via reversible prefixed_id.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94462
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.639
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method: 'PATCH'
  selection_uri:
    cs-uri-stem|contains: '/api/v3/store/carts/'
  selection_action:
    cs-uri-stem|endswith: '/associate'
  condition: selection_method and selection_uri and selection_action
falsepositives:
  - Legitimate cart association by the true cart owner (normal guest-to-account conversion).
level: medium

YARA Rule

rule CVE_2026_94462_Spree_Cart_Associate
{
    meta:
        author = "Threat Intelligence"
        description = "Detects Spree controller source referencing the vulnerable cart association path (CVE-2026-94462)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94462"
        date = "2026-01-01"
    strings:
        $a = "find_cart_for_association"
        $b = "Spree::Api::V3::Store::CartsController"
        $c = "associate"
        $d = "prefixed_id"
    condition:
        uint32(0) == 0x7f454c46 or
        ( $b and $a ) or
        ( $b and $c and $d and #a > 0 )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94462 Spree Store API Cart Association Abuse Attempt"; flow:to_server,established; http.method; content:"PATCH"; http.uri; content:"/api/v3/store/carts/"; content:"/associate"; distance:0; classtype:attempted-user; reference:cve,2026-94462; metadata:affected_product Spree, attack_target Web_Server, created_at 2026_01_01; sid:2026094462; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ http where http.request.method == "PATCH"
      and http.request.uri : "/api/v3/store/carts/*/associate" ]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri, cs_uri_stem, url, request)
| eval method = coalesce(http_method, cs_method, method)
| where method="PATCH" AND match(uri, "/api/v3/store/carts/.+/associate")
| stats count values(uri) as targeted_uris by src_ip, user, status
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,spree,cve-2026-94462">
  <rule id="100462" level="10">
    <if_sid>31100</if_sid>
    <field name="method">PATCH</field>
    <url>/api/v3/store/carts/</url>
    <url>/associate</url>
    <description>CVE-2026-94462: Possible Spree Store API cart association abuse (IDOR on guest cart)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94462,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no patch tracked):

   • If feasible, restrict the PATCH /api/v3/store/carts/:id/associate endpoint at the reverse proxy/WAF so it is reachable only from trusted flows, or block requests that arrive without the cart's own token/session context (the missing check is precisely what must be compensated for at the edge).
   • Require login for checkout on affected storefronts, which removes the guest-cart-with-address precondition described in the advisory.
   • Minimize stored billing/shipping data in guest carts until a patch is applied; treat guest cart address data as sensitive.
   • Monitor for repeated PATCH .../associate calls from a single authenticated account, which is the signature of cart harvesting.

2. Patch / upgrade steps:

   • The NVD description states the issue is fixed in Spree 5.4.4 and 5.5.4. Upgrade to these versions (or later) once available/verified in your environment. Verify the release notes and the fix for find_cart_for_association / the associate action before rollout.
   • Track the upstream Spree repository and the official advisory for the authoritative fix commit; no patch source is currently tracked in this dataset, so validate the fix before relying on it.

3. Long-term hardening:

   • Enforce object-level authorization (ownership checks) on all state-changing API actions, not merely authentication. Cart association should require proof of possession (cart token/session binding).
   • Replace reversible prefixed_id values used as externally addressable object references with non-guessable identifiers or add server-side authorization on top of them.
   • Add regression tests for IDOR on cart/user association endpoints.
   • Adopt a coordinated-disclosure and dependency-update process (e.g., Dependency-Track, Dependabot) so Rails/Spree advisories are actioned promptly.

References

• NVD — CVE-2026-94462: https://nvd.nist.gov/vuln/detail/CVE-2026-94462
• Spree (open-source e-commerce, Ruby on Rails) project: https://spreecommerce.org
• Spree source repository (fix in 5.4.4 / 5.5.4 per NVD description): https://github.com/spree/spree
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• CISA Known Exploited Vulnerabilities Catalog (not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or in-the-wild campaign is documented in the available data.