spreecommerce Spree any version

Spreecommerce < 0.60.2 Search Parameter RCE

Spreecommerce < 0.50.x API RCE

Authorization bypass in Spree

Spree allows unauthenticated users can access all guest addresses

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

Spree API has Unauthenticated IDOR - Guest Address

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.