# CVE-2026-54643: CubeCart missing delete permission check in order notes handler

Source: https://junglewise.ai/threats/cve-2026-54643-cubecart-missing-delete-permission-check-in-order-notes-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54643 · Severity: medium · CVSS 5.4 · Published 2026-09-17

CubeCart is a web-based ecommerce platform that manages product catalogs and customer orders. A privilege-escalation vulnerability in versions prior to 6.7.5 allows authenticated administrators without order-deletion permissions to permanently delete order-history notes, removing audit trails and operational records that may be required for compliance or dispute resolution.

Technologies: [CubeCart](https://junglewise.ai/threats/technologies/cubecart). Vendors: [CubeCart](https://junglewise.ai/threats/vendors/cubecart).

## Quick answers

**Is CVE-2026-54643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54643 being exploited in the wild.

**How severe is CVE-2026-54643?** Medium severity, with a CVSS score of 5.4, published 17 September 2026.

**Which products and versions are affected?** CubeCart prior to 6.7.5.

**Is there a fix for CVE-2026-54643?** A patch was published on 2026-09-17: Version 6.7.5 includes the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54643 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54643?** Check whether you run CubeCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The delete-note handler in admin/sources/orders.index.inc.php fails to verify the CC_PERM_DELETE permission flag before removing records from the CubeCart_order_notes table. The vulnerable code checks only for the presence of order_id and delete-note GET parameters, allowing any authenticated admin session to invoke the handler and delete notes belonging to any order. The fix (applied in 6.7.5) adds a permission check via Admin::getInstance()->permissions('orders', CC_PERM_DELETE) before permitting deletion. This is an authenticated, network-reachable privilege-escalation vulnerability with low attack complexity; an admin lacking delete privileges can directly call the vulnerable handler with valid order identifiers.

## Affected products

- CubeCart CubeCart prior to 6.7.5

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: patched: Version 6.7.5 includes the fix

## References

- [https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php](https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php)
- [https://github.com/cubecart/v6/commit/2c1a3fc31a8d4aecbc8c4aa02ed878aac4d71879](https://github.com/cubecart/v6/commit/2c1a3fc31a8d4aecbc8c4aa02ed878aac4d71879)

## Related threats

- [CubeCart broken access control in GDPR customer purge](https://junglewise.ai/threats/cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge)
- [CubeCart SQL injection in download_expire settings parameter](https://junglewise.ai/threats/cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter)
- [CubeCart SQL identifier injection in maintenance tools](https://junglewise.ai/threats/cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools)
- [CubeCart stored XSS in product description fields](https://junglewise.ai/threats/cve-2026-54645-cubecart-stored-xss-in-product-description-fields)
- [CubeCart XSS in GUI messages via unsafe anchor attributes](https://junglewise.ai/threats/cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes)