CVE-2026-54648

Overview

CubeCart prior to version 6.7.5 contains an access control flaw in its administrator GDPR management tools. Read-only administrators can invoke unauthorized delete commands to purge customer records. This impacts data integrity and availability by allowing unauthorized data destruction.

Description

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for the purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5.

Impact

This vulnerability primarily impacts the integrity and availability of organizational data within the ecommerce platform. Authenticated users with restricted read-only customer privileges can bypass interface restrictions to irreversibly delete customer accounts, guest accounts, and records without orders. No confidentiality impact is observed, but improper data loss can disrupt business operations and violate compliance policies.

Remediation

Upgrade CubeCart to version 6.7.5 or later where proper permission checks have been implemented for GDPR purge and delete functions. Conduct a review of current administrator role assignments to ensure the principle of least privilege is enforced. Monitor administrative audit logs for unexpected invocations of customer deletion commands.

Risk context

This vulnerability is rated as high severity with a CVSS v3 score of 6.5, though exploitation requires prior administrative authentication. EPSS data is not currently available for this CVE. Defenders should prioritize patching as part of standard maintenance cycles to prevent unauthorized data removal.

Affected products

• CubeCart < 6.7.5