CVE-2026-54643

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.

• CWE-862

• https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
• https://github.com/cubecart/v6/commit/2c1a3fc31a8d4aecbc8c4aa02ed878aac4d71879
• https://github.com/cubecart/v6/releases/tag/6.7.5
• https://github.com/cubecart/v6/security/advisories/GHSA-8mmq-8hpq-2h23
• https://github.com/cubecart/v6/security/advisories/GHSA-8mmq-8hpq-2h23

Published

Sep 17, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54636Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron pl…9.9
• CVE-2026-54637Dragonfly is an open source P2P-based file distribution and …5.5
• CVE-2026-54638gotd/td is a T Telegram MTProto API client in Go. Prior to 0…7.5
• CVE-2026-54639Style Dictionary, a build system for creating cross-platform…8.8
• CVE-2026-5464The ExactMetrics – Google Analytics Dashboard for WordPress …7.2
• CVE-2026-54642CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.3
• CVE-2026-54644CubeCart is an ecommerce software solution. Prior to 6.7.5, …6.1
• CVE-2026-54645CubeCart is an ecommerce software solution. Prior to 6.7.5, …4.8
• CVE-2026-54646CubeCart is an ecommerce software solution. Prior to 6.7.5, …7.2
• CVE-2026-54647CubeCart is an ecommerce software solution. Prior to 6.7.5, …7.2
• CVE-2026-54648CubeCart is an ecommerce software solution. Prior to 6.7.5, …6.5
• CVE-2026-54649punchin-email is a Cloudflare Email Worker that provides two…2.1