CVE-2026-54643CWE-862broken-access-control

CVE-2026-54643

Medium · published September 18, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-18T02:17Z
References (5)
https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php · [email protected]https://github.com/cubecart/v6/commit/2c1a3fc31a8d4aecbc8c4aa02ed878aac4d71879 · [email protected]https://github.com/cubecart/v6/releases/tag/6.7.5 · [email protected]https://github.com/cubecart/v6/security/advisories/GHSA-8mmq-8hpq-2h23 · [email protected]https://github.com/cubecart/v6/security/advisories/GHSA-8mmq-8hpq-2h23 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:53Z
    EPSS moved — → 0%
    epss
  • 17 SEP 22:05Z
    CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
    cvelistv5