CVE-2025-59413

Published: Sep 22, 2025Modified: Sep 23, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Exploitability: 3.9 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

Affected (1)

Products: Cubecart: Cubecart

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cubecart Cubecart	Before 6.5.11

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (5)

https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79

Source: security-advisories@github.com

Patch

https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271

Source: security-advisories@github.com

Patch

https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128

Source: security-advisories@github.com

Patch

https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.