AIKIDO-2026-659257

solidus_core is vulnerable to Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled KeyGHSA-vgwx-9pm9-8qvj Published 6 days ago

Low Risk

This Affects:

solidus_core

0.0.1 - 4.6.3

Fixed in 4.6.4

4.7.0 - 4.7.1

Fixed in 4.7.2

Are you affected? Scan for Free

TL;DR

Spree::PaymentCreate builds a new credit card payment source directly from client supplied gateway_customer_profile_id and gateway_payment_profile_id attributes without checking who owns the matching stored Spree::CreditCard record. A customer can submit another shopper's gateway profile id during checkout and attach that shopper's stored payment method to their own order. The fix raises ActiveRecord::RecordNotFound when either id already belongs to a CreditCard owned by a different user.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your store lets customers submit a gateway profile id when creating a payment through Spree::PaymentCreate.