AIKIDO-2026-34071
solidus_api is vulnerable to Improper Enforcement of Behavioral Workflow
53
Medium Risk
This Affects:
solidus_apiTL;DR
Spree::Api::CheckoutsController#update_order_state sets @order.state directly from the client supplied params[:state] without checking that the order is in the target state or has already passed it. A caller can set an order's checkout state to skip steps such as payment or confirmation. The fix only applies the requested state when Spree::Api::Config.allow_arbitrary_state_in_checkout is enabled or the order has already passed that step, and otherwise responds with a 422 invalid state error.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
solidus_api is vulnerable to Improper Enforcement of Behavioral Workflow in versions 0.0.1 - 4.6.3 and 4.7.0 - 4.7.1.
How to fix this
Upgrade the solidus_api library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.