Read the docs
TI-2026-39475 Aliases CVE-2026-54648

CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

Priority MEDIUM 62CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for the purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00594 48th percentileScored 2026-11-07
Fix Fixed v6 (cubecart): 6.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cubecartv6before 6.7.56.7.5Patch availableCNA
  • v6 Vendorcubecart Affected before 6.7.5 Fixed in 6.7.5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*——cubecart
  • cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:* Versions — — ·cubecart

Remediation

  • Fix · CNA v6 (cubecart) Fixed in 6.7.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54648

References

Other 4

  • TI-2024-23117 Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2026-33453 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVSS 3.1CRITICAL 9.1
  • TI-2026-32902 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API CVSS 3.1CRITICAL 9.1
  • TI-2026-32334 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVSS 3.1CRITICAL 9.1
  • TI-2026-32904 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header CVSS 3.1HIGH 8.1
  • TI-2024-22066 File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to… CVSS 3.1HIGH 8.0
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences