CVE-2020-15269

critical

Description

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

References

Advisories

https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh

https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847

Details

Source: Mitre, NVD

Published: 2020-10-20

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.00257