CVE-2026-116461 Details
Description
A vulnerability was determined in Omega Solution Restro POS up to 20261026. This impacts an unknown function of the file /sale-invoice/. Executing a manipulation of the argument productUnitSalePrice can lead to business logic errors. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A business logic vulnerability has been identified in Omega Solution Restro POS versions prior to 20261026. The issue arises in the sale invoice creation process, where the application improperly trusts client-supplied product prices. Instead of validating prices against the server database, the backend accepts manipulated values from authenticated users. This flaw can be exploited remotely, leading to significant financial implications for restaurants by allowing products to be purchased for much less than their actual price.
The application should be updated to remove 'productUnitSalePrice' from client-controlled input and instead fetch the official product price from the server using the 'productId'. All pricing calculations should be performed on the server side, with invoices validated before processing payments. Additionally, abnormal pricing discrepancies should be logged and monitored for fraud detection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/4m3rr0r/PoCVulDb/issues/29 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/cve/CVE-2026-116461 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1013221 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426359 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426359/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-840 | Business Logic Errors | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Omega Solution Restro POS | <= 20261026 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |