CVE-2026-54648

Katalog CVE

CVSS 6.5 · Medium EPSS 0,59%

Kerentanan Missing Authorization. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for the purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5.

Rincian

Terbit di NVD

17 September 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
• https://github.com/cubecart/v6/commit/ddcaadb1701d32045c0388f94a2a8d2a1e42e7c0
• https://github.com/cubecart/v6/releases/tag/6.7.5
• https://github.com/cubecart/v6/security/advisories/GHSA-r376-2wr5-g9qx