CVE-2026-54643 — CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note …
Published: 2026-09-17 · CVSS: 5.4 · CVSS 3.1
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7