You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification
Moderate severity
GitHub Reviewed
Published
Jan 8, 2026
in
spree/spree
•
Updated Jan 11, 2026