CVE-2026-54648

Published: Sep 17, 2026Modified: Sep 23, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.2 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for the purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (5)

https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php

Source: security-advisories@github.com

https://github.com/cubecart/v6/commit/ddcaadb1701d32045c0388f94a2a8d2a1e42e7c0

Source: security-advisories@github.com

https://github.com/cubecart/v6/releases/tag/6.7.5

Source: security-advisories@github.com

https://github.com/cubecart/v6/security/advisories/GHSA-r376-2wr5-g9qx

Source: security-advisories@github.com

https://github.com/cubecart/v6/security/advisories/GHSA-r376-2wr5-g9qx

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.