CVE-2025-59413 CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
Attackers can unsubscribe any user from newsletters by manipulating a parameter, requiring patching to enforce proper authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59413?
CVE-2025-59413 is a medium-severity missing authorization vulnerability in cubecart v6, published on 22 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.
Weakness: CWE-862
Which versions are affected by CVE-2025-59413?
It affects 1 product.
Products include Cubecart Cubecart.
How do I fix CVE-2025-59413?
No fix has been published for CVE-2025-59413 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-59413 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59413 exists.
Other vulnerabilities in cubecart v6
Sources
Also known as GHSA-869v-gjv8-9m7f.