CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

Description

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.

Scores

EPSS (exploitation in 30 days)

0.38% · top 68% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-862: Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs

Affected products

• cubecart · v6

  • affected < 6.7.5

References (4)

• https://github.com/cubecart/v6/security/advisories/GHSA-8mmq-8hpq-2h23 (opens in a new tab)x_refsource_CONFIRMexploit
• https://github.com/cubecart/v6/commit/2c1a3fc31a8d4aecbc8c4aa02ed878aac4d71879 (opens in a new tab)x_refsource_MISC
• https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php (opens in a new tab)x_refsource_MISC
• https://github.com/cubecart/v6/releases/tag/6.7.5 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-54643](https://trackcve.app/badge/CVE-2026-54643.svg)](https://trackcve.app/cve/CVE-2026-54643)

Record last updated 18 Sept 2026, 13:06 UTC.