CVE-2026-54643 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
Authenticated administrators without order modification privileges can delete order history notes, compromising audit trails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54643?
CVE-2026-54643 is a medium-severity missing authorization vulnerability in cubecart v6, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.
Weakness: CWE-862
Which versions are affected by CVE-2026-54643?
How do I fix CVE-2026-54643?
No fix has been published for CVE-2026-54643 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54643 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54643 exists.
Sources
Also known as GHSA-8mmq-8hpq-2h23.