CWE-639

{
  "affected": [],
  "aliases": [
    "CVE-2025-14073"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-01T09:16:57Z",
    "severity": "MODERATE"
  },
  "details": "The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.",
  "id": "GHSA-p553-vwc7-337r",
  "modified": "2026-08-01T09:30:24Z",
  "published": "2026-08-01T09:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14073"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/tags/3.3.0/modules/ppcp-axo/src/AxoModule.php#L362"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3458079/woocommerce-paypal-payments/trunk/modules/ppcp-axo/src/AxoModule.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-paypal-payments/tags/3.3.2\u0026new_path=%2Fwoocommerce-paypal-payments/tags/3.4.0"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2919bbc-c4c2-4b52-90ec-2471218cd7d1?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-24892"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-23T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Insecure Direct Object Reference in edit function of Advanced Forms (Free \u0026 Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user\u0027s email address and request for reset password, which could lead to take over of WordPress\u0027s administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress\u0027s user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.",
  "id": "GHSA-p5hv-vfxr-c3g7",
  "modified": "2022-05-24T19:21:13Z",
  "published": "2022-05-24T19:21:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24892"
    },
    {
      "type": "WEB",
      "url": "https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/364b0843-a990-4204-848a-60c928cc5bc0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-45892"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-02T21:15:09Z",
    "severity": "HIGH"
  },
  "details": "An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information.",
  "id": "GHSA-p5jr-rfj3-98f5",
  "modified": "2024-01-08T21:30:32Z",
  "published": "2024-01-02T21:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45892"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Oracle-Security/CVEs/blob/main/FloorsightSoftware/CVE-2023-45892.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-80049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T19:16:55Z",
    "severity": "HIGH"
  },
  "details": "Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults X-Airbyte-Workspace-Id ahead of every resource-derived header, including those for connection, source and destination identifiers. Endpoints whose declared request bodies carry only a resource identifier are nonetheless reached with an added workspaceId field, because the extractor reads the body rather than the endpoint\u0027s schema, so the permission check is performed against the workspace the caller nominated while the handler acts on the resource identifier the caller supplied. Nothing afterwards compares the resource\u0027s owning workspace with the one that was authorized. A member of any workspace can therefore read source and destination configuration, trigger and cancel syncs, and delete connections, sources and destinations that belong to workspaces they have no access to, at whatever privilege level their own workspace membership grants them.",
  "id": "GHSA-p5mw-j28v-ph9h",
  "modified": "2026-08-25T21:31:30Z",
  "published": "2026-08-25T21:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80049"
    },
    {
      "type": "WEB",
      "url": "https://github.com/airbytehq/airbyte-platform"
    },
    {
      "type": "WEB",
      "url": "https://github.com/airbytehq/airbyte-platform/blob/v2.0.0/airbyte-commons-server/src/main/kotlin/io/airbyte/commons/server/support/AuthenticationHeaderResolver.kt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geo-chen/oss/blob/main/airbyte-platform.md"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/airbyte-platform-through-2.0.0-cross-workspace-authorization-bypass-via-caller-supplied-workspaceid"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-10140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T20:17:27Z",
    "severity": "CRITICAL"
  },
  "details": "IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.",
  "id": "GHSA-p5v5-v74q-w38h",
  "modified": "2026-06-30T21:31:44Z",
  "published": "2026-06-30T21:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10140"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7278209"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-27742"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-28T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else\u0027s emails via the msg_confirm_move template. NOTE: this was reported to the vendor in a publicly archived \"Multiple Security Vulnerabilities in WebCit 926\" thread.",
  "id": "GHSA-p628-386j-64h8",
  "modified": "2022-05-24T17:32:37Z",
  "published": "2022-05-24T17:32:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27742"
    },
    {
      "type": "WEB",
      "url": "https://www.citadel.org"
    },
    {
      "type": "WEB",
      "url": "http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "in2code/powermail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "12.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "in2code/powermail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "10.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "in2code/powermail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "in2code/powermail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-29T17:59:02Z",
    "nvd_published_at": "2024-08-29T00:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, resulting in Insecure Direct Object Reference (IDOR). An unauthenticated attacker can use this to display the user-submitted data of all forms persisted by the extension. This can only be exploited when the extension is configured to save submitted form data to the database (`plugin.tx_powermail.settings.db.enable=1`), which however is the default setting of the extension. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.",
  "id": "GHSA-p652-xcgx-f85m",
  "modified": "2024-08-30T14:33:54Z",
  "published": "2024-08-29T17:59:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45232"
    },
    {
      "type": "WEB",
      "url": "https://github.com/in2code-de/powermail/commit/061756732357206f2f13bf39a0676dd266ec9586"
    },
    {
      "type": "WEB",
      "url": "https://github.com/in2code-de/powermail/commit/ac402d4972c77dd119c8db6ffe594c15e8ae0bc5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/in2code-de/powermail/commit/e2ddfaa06d29019d60be02b5a3da04b237ed760b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/in2code-de/powermail/commit/f58d70311799ae5f6acbec52ea9206d21eba91bb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/powermail/CVE-2024-45232.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/in2code-de/powermail"
    },
    {
      "type": "WEB",
      "url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-006"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "\"powermail\" (powermail) Insecure Direct Object Reference (IDOR)"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OpenListTeam/OpenList/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:32:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn authorization bypass and information disclosure vulnerability exists in the search API of `Openlist`. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned `BasePath` restrictions to discover and access metadata of files residing in unauthorized sibling directories.\n\n### Details\nThis vulnerability stems from two combined logic flaws when the `bleve` search engine is utilized:\n\n1. **Insecure Path Prefix Validation:** In the search handler (`server/handles/search.go`), the application attempts to restrict search results to the user\u0027s allowed namespace using a simple prefix check: `strings.HasPrefix(node.Parent, user.BasePath)`. Because this function is not path-separator aware, a user with a `BasePath` restricted to `/base` will successfully pass the authorization check for a completely separate directory named `/base2` (since \"/base2\" starts with \"/base\").\n\n2. **Unfiltered Total Count Leakage:** The `bleve` backend (`internal/search/bleve/search.go`) searches the index globally and ignores the `req.Parent` boundary. Even if the application later successfully filters out unauthorized items from the `Content` array (e.g., via `CanAccess` meta password checks), it still returns the raw `Total` count provided by the search backend. This allows an attacker to perform blind data-enumeration, confirming the existence of sensitive files outside their namespace by observing the `Total` count.\n\n### PoC\n**Prerequisites:**\n1. Log in as an administrator and set the Search Index Mode to `bleve`. Build the index.\n2. Create two directories at the root level: `/base` and `/base2`.\n3. Upload a sensitive file into the unauthorized directory: `/base2/secret_financial_report.pdf`.\n4. Create a low-privileged test user and strictly set their `Base path` to `/base`.\n\n**Exploitation Steps:**\n1. Authenticate as the newly created low-privileged user.\n2. Send the following HTTP request to the search API:\n```http\nPOST /api/fs/search HTTP/1.1\nHost: \u003cyour-openlist-host\u003e\nAuthorization: \u003ctest-user-token\u003e\nContent-Type: application/json\n\n{\n  \"parent\": \"/\",\n  \"keywords\": \"secret\",\n  \"page\": 1,\n  \"per_page\": 20,\n  \"scope\": 0\n}\n```\n3. Observe the response: Due to the prefix bypass (`strings.HasPrefix(\"/base2\", \"/base\") == true`), the metadata for `secret_financial_report.pdf` will be leaked in the response Content.\n    - Alternatively, even if access is further blocked by folder-level passwords, the Total field will return \u003e 0, allowing the attacker to blindly confirm the existence of the keyword \"secret\" in unauthorized global directories.\n \n\u003cimg width=\"2112\" height=\"1381\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9f8c5e18-8744-4363-8d3f-5e6cf691f061\" /\u003e\n\n### Impact\nThis is an Information Disclosure and Horizontal/Vertical Privilege Escalation vulnerability. Any authenticated user can enumerate hidden infrastructure, verify the existence of sensitive files (e.g., passwords, internal documents), and extract file metadata across the entire storage namespace, completely defeating the BasePath isolation mechanism.\n\n### Remediation Recommendations\n1. Separator-Aware Path Containment: Replace strings.HasPrefix with a robust path containment check. For example: target == base || strings.HasPrefix(target, base + \"/\"), or use a dedicated utility like utils.IsSubPath().\n2. Backend-Level Filtering: Enforce the path boundary within the bleve query itself (e.g., using indexed parent path hashes) rather than relying solely on post-query API filtering.\n3. Accurate Total Calculation: Compute the Total count only after all authorization and path filters have been applied to the result set.",
  "id": "GHSA-p6ph-3jx2-3337",
  "modified": "2026-07-24T22:32:17Z",
  "published": "2026-07-24T22:32:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenListTeam/OpenList"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_storefront"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_storefront"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_storefront"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_storefront"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.0"
            },
            {
              "fixed": "5.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25757"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-05T21:13:24Z",
    "nvd_published_at": "2026-02-06T23:15:54Z",
    "severity": "HIGH"
  },
  "details": "### Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)\n\nThe `OrdersController#show` action permits viewing completed guest orders by order number alone, without requiring the associated order token.\n\nOrder lookup without enforcing token requirement in [`OrdersController#show`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14):\n\n```ruby\n@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first\n```\n\nAuthorization bypass for guest orders in [`authorize_access`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8):\n```ruby\ndef authorize_access\n  return true if @order.user_id.nil?\n\n  @order.user == try_spree_current_user\nend\n```\n\nIf the attacker is in possession of a leaked Order ID, they might look it up directly via this API.\nAlternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are [securely generated](https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45), but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)\n\n\n#### Proof of Concept\n\n1. As a guest create a complete order.\n2. Fetch the latest Order ID from the database (Table: `spree_orders`).\n3. In another clean browser access following URL: `\u003cSPREE-HOST\u003e/orders/\u003cORDER-ID\u003e`. (Sample: `http://localhost:3000/orders/R496592563`)\n\n=\u003e Full guest order details are disclosed including names, addresses and limited payment info.\n\n#### Impact\n\nThis issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).\n\n#### CWEs\n\n- CWE-639: Authorization Bypass Through User-Controlled Key\n\n### Credit\n\nThis issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter St\u00f6ckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).\n\n### Disclosure Policy\n\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).",
  "id": "GHSA-p6pv-q7rc-g4h9",
  "modified": "2026-02-13T17:16:21Z",
  "published": "2026-02-05T21:13:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25757"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_storefront/CVE-2026-25757.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spree/spree"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Unauthenticated Spree Commerce users can view completed guest orders by Order ID"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-12116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-11T08:15:24Z",
    "severity": "MODERATE"
  },
  "details": "The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.1 via the \u0027uta-template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.",
  "id": "GHSA-p6wv-4rvr-m4fh",
  "modified": "2026-04-08T18:33:47Z",
  "published": "2025-01-11T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12116"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3220786%40unlimited-theme-addons\u0026new=3220786%40unlimited-theme-addons\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/unlimited-theme-addons"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbdb6cc-2a00-4d34-9c11-62f3d1b51c73?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}