Medium severity · published Sep 17, 2026
CVE-2026-54643
CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V6
v6 · cubecart
< 6.7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54643
github.com
https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
github.com
https://github.com/cubecart/v6/commit/2c1a3fc31a8d4aecbc8c4aa02ed878aac4d71879
github.com
https://github.com/cubecart/v6/releases/tag/6.7.5
github.com
https://github.com/cubecart/v6/security/advisories/GHSA-8mmq-8hpq-2h23
More from v6
9.1
CVE-2026-45714
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
9.1
CVE-2026-45053
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
9.1
CVE-2026-44377
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
8.1
CVE-2026-45055
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
7.2
CVE-2026-54647
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php