Unauthenticated Spree Commerce users can view completed guest orders by Order ID
This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).
Advisories for Gem/Spree_storefront package
2026
This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).