CVE-2026-54643

CubeCart prior to version 6.7.5 is affected by a missing authorization check in the delete-note handler (admin/sources/orders.index.inc.php). The handler verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring the CC_P...