CVE-2026-114267 Details
Description
A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.
A broken access control vulnerability has been identified in SourceCodester Food Order Management System version 1.0. Several administrative endpoints can be accessed directly without proper authentication or authorization checks. This vulnerability allows unauthenticated users to invoke administrative functions remotely. Affected endpoints include 'admin/add_admin.php', 'admin/add_category.php', 'admin/add_food.php', 'admin/update_category.php', 'admin/update_food.php', 'admin/delete.php', 'admin/delete_category.php', 'admin/change_pwd.php', and 'admin/edit_admin.php'. The main 'admin.php' page attempts to verify the user's session but fails to enforce authorization consistently across all administrative endpoints.
It is recommended to implement a centralized server-side authorization mechanism for all administrative endpoints. This should include verifying that the user has an authenticated administrative session before processing requests, terminating unauthorized requests immediately, and applying a deny-by-default authorization policy for administrative functions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/amanaparvin123-pixel/security-research/blob/main/food-order-admin-access.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-114267 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1018876 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/424699 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/424699/cti | [email protected] | AdvisoryPermission Required |
| https://www.sourcecodester.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SourceCodester Food Order Management System | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |