CVE-2026-25758

CVE-2026-25758 is a critical Insecure Direct Object Reference (IDOR) vulnerability in Spree Commerce's guest checkout flow, affecting all versions prior to 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2. This flaw allows unauthenticated guest users to bind arbitrary guest addresses to their orders by manipulating address IDs, leading to unauthorized access to other guests' Personally Identifiable Information (PII) such as names, addresses, and phone numbers. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction, resulting in high confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the KEV catalog, though it has received some community discussion and media coverage.