Executive brief
CubeCart is a web-based ecommerce platform that manages product catalogs and customer orders. A privilege-escalation vulnerability in versions prior to 6.7.5 allows authenticated administrators without order-deletion permissions to permanently delete order-history notes, removing audit trails and operational records that may be required for compliance or dispute resolution.
Technical details
The delete-note handler in admin/sources/orders.index.inc.php fails to verify the CC_PERM_DELETE permission flag before removing records from the CubeCart_order_notes table. The vulnerable code checks only for the presence of order_id and delete-note GET parameters, allowing any authenticated admin session to invoke the handler and delete notes belonging to any order. The fix (applied in 6.7.5) adds a permission check via Admin::getInstance()->permissions('orders', CC_PERM_DELETE) before permitting deletion. This is an authenticated, network-reachable privilege-escalation vulnerability with low attack complexity; an admin lacking delete privileges can directly call the vulnerable handler with valid order identifiers.
Affected products
- CubeCart CubeCart prior to 6.7.5
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Version 6.7.5 includes the fix