CVE-2026-45055 Details
Description
CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in User::passwordRequest() (and the admin equivalent in Admin::passwordRequest()). An unauthenticated attacker who knows a target email can POST /index.php?_a=recover with Host: evil.com; CubeCart writes a fresh verify token (valid 3,600 s) and emails the victim a link http://evil.com/index.php?_a=recovery&validate=<TOKEN>. The token is valid against the legitimate store — capturing the victim's click on evil.com yields full account takeover, or store takeover when an admin email is targeted. This vulnerability is fixed in 6.7.2.
A vulnerability in CubeCart versions 6.6.x through 6.7.1 allows for pre-authenticated account takeover via a host header injection. The application constructs the 'CC_STORE_URL' constant directly from the 'Host' request header without any validation. This URL is then included in transactional emails, such as password reset links. An unauthenticated attacker can exploit this by sending a POST request to the password recovery endpoint with a forged 'Host' header. The victim receives an email with a link containing a verification token that, when clicked, grants access to their account. If an admin email is targeted, the attacker gains full control over the store.
Users can upgrade to CubeCart version 6.7.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 13, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cubecart/v6/security/advisories/GHSA-7pvc-gxc4-chmc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cubecart/v6/security/advisories/GHSA-7pvc-gxc4-chmc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CubeCart | <= 6.7.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |