CVE-2026-116604 Details

A missing authentication vulnerability has been identified in SourceCodester Online Food Ordering System version 1.0. The issue resides in the admin/delete_admin.php file, where an unknown function fails to properly authenticate users before allowing the deletion of admin accounts. This vulnerability can be exploited remotely, as the endpoint does not require any authentication to access. The problem has been publicly disclosed and is confirmed to be reproducible on a local XAMPP test instance.

To address this vulnerability, include a check for user authentication by adding 'include(user_logged.php);' at the top of the delete_admin.php script, before any database operations are performed. Additionally, modify the user_logged.php file to include an 'exit();' command after the redirect header, ensuring that script execution stops and does not continue past the login redirect.