CVE-2025-59413

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79	Patch
https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271	Patch
https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128	Patch
https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f	Exploit Vendor Advisory
https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-09-22 17:16

Updated : 2025-09-23 16:49

NVD link : CVE-2025-59413

Mitre link : CVE-2025-59413

CVE.ORG link : CVE-2025-59413

JSON object : View

Products Affected

cubecart

cubecart

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-59413", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-09-22T17:16:09.037", "references": [{"url": "https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber\u2019s email address. This issue has been patched in version 6.5.11."}], "lastModified": "2025-09-23T16:49:02.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE2B06FC-9BF4-4BAF-9B38-1FD7B55A766E", "versionEndExcluding": "6.5.11"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}