---
id: "CVE-2026-114267"
kind: "vulnerability"
aliases: ["CVE-2026-114267"]
title: "SourceCodester Food Order Management System: admin endpoint lacks authorization checks"
severity: "high"
cvss: 7.5
epss: 0.00307
exploited: false
status: "open"
category: "package"
products: [{"name": "Food Order Management System", "fixed": [], "affected": "1.0", "ecosystem": "sourcecodester"}]
ecosystems: []
tags: ["missing-authorization", "package", "php", "self-hosted", "sourcecodester", "web-app"]
not_affected_if: ["admin-area-blocked-at-network", "not-deployed"]
published_at: "2026-10-21T19:17:00+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:19:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114267", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114267", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:19:41+00:00"}]
---

# SourceCodester Food Order Management System: admin endpoint lacks authorization checks

SourceCodester Food Order Management System 1.0 has admin PHP endpoints (add_admin, add_food, change_pwd, delete, edit_admin and others) with no server-side authentication check. An unauthenticated remote attacker can create admin accounts, change admin passwords, edit or delete data. A public write-up exists and no fix has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- sourcecodester:Food Order Management System affected 1.0 fixed ?

## How to check

- Find any SourceCodester Food Order Management System 1.0 install (PHP app with an admin/ folder).
- Without logging in, request admin/add_admin.php, add_food.php, change_pwd.php and delete.php, and check whether they respond instead of redirecting to login. Only test your own instance.
- Open those files and check for a session check followed by exit; admin.php redirects without exit.
- Check web logs for unauthenticated hits on /admin/*.php, and look for unknown admin accounts or changed prices.

## Fix

No fixed version exists; the vendor has published nothing. Until one does, block /admin/ at the web server (IP allowlist or HTTP basic auth) or take the app offline. Code-level fix: put session_start() and an isset($_SESSION['user']) check followed by exit at the top of every admin/*.php file.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114267
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114267
- 2026-10-25T03:19:41+00:00 analyst — Read CVE record, VulDB VDB-424699 and the researcher's public write-up (PoC). No vendor advisory or fix exists; VulDB says no mitigation known. Feedly's 'patch available' claim cites a GHSA I could not confirm, so I ignored it. Nothing marked verified, since there is no vendor source.

## Documents

- [advisory] VDB-424699 SourceCodester Food Order Management System 1.0 Admin Endpoint authorization https://vuldb.com/?id.424699
- [advisory] CVE Record CVE-2026-114267 https://www.cve.org/CVERecord?id=CVE-2026-114267
- [poc] Unauthenticated Administrative Access in Food Order Management System (researcher write-up) https://github.com/amanaparvin123-pixel/security-research/blob/main/food-order-admin-access.md

## From the sources

A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_