Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-54643

CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

CVSS 3.1 5.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-54643

Published

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-54643

Published

v6

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "cubecart",
                    "product": "v6",
                    "versions": [
                        {
                            "version": "< 6.7.5",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON