CVE-2026-54643

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5

Description An authenticated administrator without order modification privileges can delete order-history notes, which removes operational records and audit-trail data. This occurs because the delete-note handler in the 'admin/sources/orders.index.inc.php' endpoint only verifies the presence of the order id and delete-note parameters and does not require the CC PERM DELETE permission for orders.

Recommendations Update to version 6.7.5.