In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15269
Reference (s):
- https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh
- URL: https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh
- https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847
- URL: https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847