CVE-2026-54648: CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CubeCartto a version that resolves this vulnerability.Fixed in 6.7.5
Event History
Frequently Asked Questions
Which administrators are able to exploit this issue?
Authenticated administrators who have read-only customer privileges can exploit it. They do not need the customer delete permission because the affected backend actions check only page-level CC_PERM_READ access.
What actions can an attacker perform?
They can directly invoke the purge, no_order_purge, or delete_guests backend commands. This can irreversibly delete customer records, accounts without orders, or guest accounts.
Are installations running the fixed release affected?
No. The issue affects CubeCart versions prior to 6.7.5 and is fixed in version 6.7.5.
What should be done if an immediate upgrade is not possible?
Restrict customer read access to trusted administrators, since that permission is sufficient to invoke the vulnerable backend actions in affected versions.