CVE-2026-54648: CWE-862: Missing Authorization in cubecart v6
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for the purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5.
AI Analysis
Technical Summary
CubeCart ecommerce software versions before 6.7.5 have a missing authorization vulnerability (CWE-862) in the GDPR tools located in admin/sources/customers.gdpr.inc.php. The vulnerability arises because these tools check only for CC_PERM_READ access at the page level and do not require CC_PERM_DELETE for purge-related commands. As a result, an authenticated administrator with read-only customer privileges can directly invoke backend actions to delete customer data, bypassing interface restrictions. This leads to irreversible deletion of customer records, accounts without orders, or guest accounts, impacting data integrity and availability. The vulnerability is resolved in CubeCart version 6.7.5.
Potential Impact
An attacker with authenticated administrator access but only read-only customer privileges can exploit this vulnerability to irreversibly delete customer data, including customer records, accounts without orders, and guest accounts. This results in loss of data integrity and availability within the affected CubeCart installations.
Mitigation Recommendations
Upgrade CubeCart to version 6.7.5 or later, where this missing authorization vulnerability has been fixed. No other mitigations are indicated by the vendor advisory.
CVE-2026-54648: CWE-862: Missing Authorization in cubecart v6
Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for the purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5.
CVSS v3.1
Score 6.5medium
Affected software
cubecart
v6
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CubeCart ecommerce software versions before 6.7.5 have a missing authorization vulnerability (CWE-862) in the GDPR tools located in admin/sources/customers.gdpr.inc.php. The vulnerability arises because these tools check only for CC_PERM_READ access at the page level and do not require CC_PERM_DELETE for purge-related commands. As a result, an authenticated administrator with read-only customer privileges can directly invoke backend actions to delete customer data, bypassing interface restrictions. This leads to irreversible deletion of customer records, accounts without orders, or guest accounts, impacting data integrity and availability. The vulnerability is resolved in CubeCart version 6.7.5.
Potential Impact
An attacker with authenticated administrator access but only read-only customer privileges can exploit this vulnerability to irreversibly delete customer data, including customer records, accounts without orders, and guest accounts. This results in loss of data integrity and availability within the affected CubeCart installations.
Mitigation Recommendations
Upgrade CubeCart to version 6.7.5 or later, where this missing authorization vulnerability has been fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T20:16:46.198Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aac671555bf5e2cf5ffd690
Added to database: 09/17/2026, 22:17:57 UTC
Last enriched: 09/17/2026, 22:31:48 UTC
Last updated: 09/18/2026, 01:29:37 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.