{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "a7a0d71e5ae979f2a13e8b4cde591c040f1109e4"
            }
          ],
          "repo": "https://github.com/cubecart/v6",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-869v-gjv8-9m7f"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59413.json"
  },
  "details": "CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.",
  "id": "CVE-2025-59413",
  "modified": "2026-04-01T23:09:02.641101982Z",
  "published": "2025-09-22T16:15:00.351Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59413.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59413"
    },
    {
      "type": "FIX",
      "url": "https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79"
    },
    {
      "type": "FIX",
      "url": "https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271"
    },
    {
      "type": "FIX",
      "url": "https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter"
}