CubeCart ecommerce software versions before 6.7.5 have a missing authorization check (CWE-862) in the delete-note handler located in admin/sources/orders.index.inc.php. This handler verifies only the presence of order_id and delete-note parameters before deleting records from the CubeCart_order_notes database table, but does not require the CC_PERM_DELETE permission for orders. Consequently, an authenticated administrator lacking order modification privileges can delete order-history notes, impacting audit trails. The vulnerability is addressed in CubeCart version 6.7.5.

The vulnerability allows an authenticated administrator without proper order modification permissions to delete order-history notes. This can result in loss of operational records and audit-trail data, potentially hindering investigations or accountability. There is no direct confidentiality impact, but integrity and availability of order notes are affected.

Upgrade CubeCart to version 6.7.5 or later, where this missing authorization check has been fixed. Until then, restrict administrator access to trusted users only and monitor for unauthorized deletion of order notes. No other vendor advisories or temporary fixes are provided.