CVE-2026-103538
MediumCVSS 6.5Summary
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0 affecting the OrderController.deleteOrder function of the Order Deletion Endpoint. Manipulating the orderId argument results in missing authentication. The attack can be carried out remotely. The exploit has been publicly released and may be used. The project was informed but has not responded.
Risk Assessment
Missing authentication in order deletion can enable unauthorized data deletion and system integrity compromise.
Recommendation
Immediately restrict access to the order deletion endpoint, apply fixes, or consider disabling the component until patched.
Other vulnerabilities in ZongXR SuperMarket
See all- CVE-2026-103539Medium
A weakness has been identified in ZongXR SuperMarket 1.0.0.0 affecting the startBuy function of the Instant Buy component. Manipulating the Username argument leads to missing authentication. The attack can be performed remotely. The exploit has been publicly disclosed and may be used for attacks. The project was informed but has not responded.
- CVE-2026-103536High
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected is the function OrderController.addOrder in order/src/main/java/com/supermarket/order/controller/OrderController.java of the save Endpoint component. Manipulation of the userId argument leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used; the project was informed but has not responded.
Original NVD description (English source)
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS