CVE-2026-54643: CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CubeCartto a version that resolves this vulnerability.Fixed in 6.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated CubeCart administrator account is required. The affected account can lack order modification privileges, because the vulnerable delete-note handler does not require the CC_PERM_DELETE permission for orders.
What impact can exploitation have?
An attacker with a qualifying administrator account can directly invoke the handler using valid order and note identifiers to delete order-history notes. This can remove operational records and audit-trail data, but the provided data does not indicate disclosure of data or broader system compromise.
Which deployments are affected and what is the remediation?
CubeCart versions prior to 6.7.5 are affected. Upgrade to version 6.7.5, which fixes the missing authorization check.