{"id":"CVE-2025-59413","aliases":["EUVD-2025-30840","GHSA-869v-gjv8-9m7f"],"status":"published","title":"CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter","description":"CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00397,"percentile":0.34216,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-09-22T16:15:00Z","modified":"2026-10-28T02:30:53Z","products":[{"vendor":"cubecart","product":"cubecart"},{"vendor":"cubecart","product":"v6"}],"references":[{"url":"https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59413.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59413","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-59413","title":"CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter","description":"CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.","status":"published","published":"2025-09-22T16:15:00.351Z","modified":"2025-09-22T17:26:29.173Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-30840","description":"CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.","status":"published","published":"2025-09-22T16:15:00Z","modified":"2025-09-22T17:26:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:31:40.869423Z"}],"nvd":[{"id":"CVE-2025-59413","description":"CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.","status":"published","published":"2025-09-22T17:16:09.037Z","modified":"2026-06-17T09:46:07.41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:30.865098Z"}],"osv":[{"id":"CVE-2025-59413","title":"CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter","description":"CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.","status":"published","published":"2025-09-22T16:15:00.351Z","modified":"2026-10-28T02:30:53.345583437Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:51.190588Z"}]}}