---
id: 5192
title: "[CVE-2026-22588] Tales From the Trace: How XBOW Reasons Its Way Into Finding IDORs"
cve: CVE-2026-22588
source_domain: xbow.com
source_url: "https://xbow.com/blog/tales-from-the-trace-how-xbow-reasons-its-way-into-finding-idors"
published_at: "2026-02-04T13:00:00Z"
tags: ["agentic-ai", "appsec", "vulnerability-research", "idor", "cve", "ai-pentesting", "authorization", "spree"]
phying_url: "https://phying.com/item/5192"
lang: en
---

# [CVE-2026-22588] Tales From the Trace: How XBOW Reasons Its Way Into Finding IDORs

## Summary

Walks through XBOW traces that found two IDORs in the Spree e-commerce framework (CVE-2026-22588/22589, patched in v5.2.5) by reasoning about objects and authorization states.

## Intelligence Metadata

- **Sources:** xbow.com
- **CVE:** CVE-2026-22588
- **Published:** 2026-02-04T13:00:00Z
- **Original:** https://xbow.com/blog/tales-from-the-trace-how-xbow-reasons-its-way-into-finding-idors
- **Phying News:** https://phying.com/item/5192