Expired token reuse in Spree

published 2020-10-20 6 y ago modified 2026-07-08 4 mo ago also GHSA-f8cm-364f-q9qh , EUVD-2020-1427

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Patch / fix

fixed in 2 links 1

rubygems spree 3.7.11, 4.0.4, 4.1.11
sparksolutions spree 3.7.11, 4.0.4, 4.1.11

github.com/spree/spree@e43643a commit

Exploit prediction

1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:N
GitHub	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
rubygems	spree	<3.7.11 >=4.0.0, <4.0.4 >=4.1.0, <4.1.11	3.7.11 4.0.4 4.1.11

Affected products

spree spree

Classification

Weakness

CWE-287 Improper Authentication
CWE-613 DEPRECATED: Insufficient Session Expiration

References

github.com /spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847
web, patch, third-party-advisory
github.com /spree/spree/security/advisories/GHSA-f8cm-364f-q9qh
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-15269
advisory
github.com /rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2020-15269.yml
web
github.com /spree/spree
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary