{"id":"CVE-2026-114267","kind":"vulnerability","aliases":["CVE-2026-114267"],"related":[],"title":"SourceCodester Food Order Management System: admin endpoint lacks authorization checks","description":"A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.","summary":"SourceCodester Food Order Management System 1.0 has admin PHP endpoints (add_admin, add_food, change_pwd, delete, edit_admin and others) with no server-side authentication check. An unauthenticated remote attacker can create admin accounts, change admin passwords, edit or delete data. A public write-up exists and no fix has been published.","severity":"high","cvss":7.5,"epss":0.00307,"exploited":false,"exploited_at":null,"products":[{"name":"Food Order Management System","fixed":[],"affected":"1.0","ecosystem":"sourcecodester"}],"ecosystems":[],"tags":["missing-authorization","package","php","self-hosted","sourcecodester","web-app"],"not_affected_if":["admin-area-blocked-at-network","not-deployed"],"how_to_check":"- Find any SourceCodester Food Order Management System 1.0 install (PHP app with an admin/ folder).\n- Without logging in, request admin/add_admin.php, add_food.php, change_pwd.php and delete.php, and check whether they respond instead of redirecting to login. Only test your own instance.\n- Open those files and check for a session check followed by exit; admin.php redirects without exit.\n- Check web logs for unauthenticated hits on /admin/*.php, and look for unknown admin accounts or changed prices.","fix":"No fixed version exists; the vendor has published nothing. Until one does, block /admin/ at the web server (IP allowlist or HTTP basic auth) or take the app offline. Code-level fix: put session_start() and an isset($_SESSION['user']) check followed by exit at the top of every admin/*.php file.","status":"open","published_at":"2026-10-21T19:17:00+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:26+00:00","updated_at":"2026-10-25T03:19:41+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:16:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SourceCodester Food Order Management System: admin endpoint lacks authorization checks","impact":"high","summary":"SourceCodester Food Order Management System 1.0 has an admin endpoint that does not check authorization. A remote attacker can reach admin functions without being properly authorized, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["php","self-hosted","web-app"],"confidence":0.5,"needs_auth":"unknown","worst_case":"remote attacker reaches admin functions without authorization","analyst_note":"Check the NVD entry and vendor or SourceCodester pages for the exact endpoint, required privileges, and any fixed version; the sources give no fix.","how_to_check":"- Confirm whether the `Food Order Management System` 1.0 application from SourceCodester is deployed on any server you run.\n- Review the admin endpoints in the application code for missing role or session checks; the sources do not name the exact endpoint file.","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Teams running the SourceCodester Food Order Management System 1.0 PHP application, usually a small self-hosted restaurant or ordering site. The sources do not name a patched version or a fix, so any instance reachable from the internet should be treated as exposed until its admin area is restricted. Teams that do not run this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000594,"input_tokens":3331,"output_tokens":522,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and vendor or SourceCodester pages for the exact endpoint, required privileges, and any fixed version; the sources give no fix.","search":"'-114267':13A,16A '-2026':12A,15A '1.0':38B,98C 'account':68B 'add':43B,45B 'admin':6A,40B,44B,51B,67B,70B,107C 'affect':99C 'app':32B 'attack':64B,116C 'authent':59B 'author':9A,23B,114C 'chang':47B,69B 'check':10A,60B 'compon':106C 'creat':66B 'cve':11A,14A 'data':75B 'delet':49B,74B 'detect':91C 'edit':50B,72B 'endpoint':7A,42B,108C 'exist':81B 'exploit':123C 'fix':84B 'food':2A,17A,34B,46B,94C 'function':103C 'host':28B 'lack':8A 'manag':4A,36B,96C 'management':19A 'manipul':110C 'may':117C,128C 'miss':22B,113C 'missing-author':21B 'order':3A,18A,35B,95C 'other':53B 'packag':24B 'password':71B 'perform':119C 'php':25B,41B 'public':77B,126C 'publish':87B 'pwd':48B 'remot':63B,121C 'result':111C 'self':27B 'self-host':26B 'server':57B 'server-sid':56B 'side':58B 'sourcecodest':1A,29B,33B,93C 'system':5A,20A,37B,97C 'unauthent':62B 'unknown':102C 'use':130C 'vulner':89C 'web':31B 'web-app':30B 'write':79B 'write-up':78B","nicknames":[],"mitigations":[],"who_affected":"Teams running the SourceCodester Food Order Management System 1.0 PHP application, usually a small self-hosted restaurant or ordering site. The sources do not name a patched version or a fix, so any instance reachable from the internet should be treated as exposed until its admin area is restricted. Teams that do not run this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114267","severity":null,"published_at":"2026-10-21T19:17:00+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114267","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114267","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114267:695","url":null,"severity":null,"published_at":"2026-10-25T03:19:41+00:00","modified_at":"2026-10-25T03:19:41+00:00","first_seen_at":"2026-10-25T03:19:41+00:00","fetched_at":"2026-10-25T03:19:41+00:00","note":"Read CVE record, VulDB VDB-424699 and the researcher's public write-up (PoC). No vendor advisory or fix exists; VulDB says no mitigation known. Feedly's 'patch available' claim cites a GHSA I could not confirm, so I ignored it. Nothing marked verified, since there is no vendor source."}],"documents":[{"id":3123,"url":"https://github.com/amanaparvin123-pixel/security-research/blob/main/food-order-admin-access.md","title":"Unauthenticated Administrative Access in Food Order Management System (researcher write-up)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3124,"url":"https://vuldb.com/?id.424699","title":"VDB-424699 SourceCodester Food Order Management System 1.0 Admin Endpoint authorization","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3126,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114267","title":"CVE Record CVE-2026-114267","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}