CVE-2026-103536 in Supermarket
Summary
by MITRE • 10/01/2026
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The identified vulnerability in ZongXR Supermarket version 1.0.0.0 represents a critical authentication bypass flaw located within the OrderController.addOrder function, specifically residing in the file order/src/main/java/com/supermarket/order/controller/OrderController.java. This component is responsible for handling requests to save new orders through its designated endpoint. The core technical issue stems from improper validation of the userId argument passed by the client during request processing. Instead of verifying that the provided user identifier corresponds to an authenticated session or extracting it securely from a validated context, the application directly utilizes this input parameter without sufficient checks against authentication tokens or session data. This design flaw allows attackers to manipulate the userId field arbitrarily, effectively impersonating any valid user in the system without possessing their credentials.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, and more specifically reflects aspects of CWE-345 regarding Insufficient Verification of Data Authenticity. The absence of robust server-side validation means that the application trusts client-supplied data implicitly for identity assertion rather than relying on secure session management mechanisms such as HTTP cookies or bearer tokens validated against a backend session store. This architectural weakness creates a direct path for unauthorized access, allowing malicious actors to perform actions under the guise of legitimate users. The impact is severe because it undermines the fundamental security principle that user identity must be established and maintained through trusted server-side state rather than mutable client inputs.
The operational impact of this vulnerability is significant due to its remote exploitability. Attackers can execute exploits over a network connection without requiring prior access or local privileges, classifying this as an attack vector with high availability according to the MITRE ATT&CK framework under techniques related to Initial Access and Privilege Escalation. Since the exploit code is publicly available, the barrier for entry is lowered considerably, increasing the likelihood of automated scanning and exploitation by threat actors targeting vulnerable instances of ZongXR Supermarket. Successful exploitation could lead to unauthorized order placement, data theft, financial fraud through manipulated transactions, or further lateral movement within the associated infrastructure if other services are linked via shared user identities.
Despite being informed early about this issue through an official report, the project maintainers have not yet responded or provided a patch. This lack of remediation leaves all deployed instances exposed to active exploitation. Organizations relying on ZongXR Supermarket 1.0.0.0 should consider immediate mitigation strategies such as implementing reverse proxy rules to restrict access to the affected endpoint, enforcing strict input validation at the gateway level, or upgrading to a patched version if one becomes available in future releases. Until an official fix is released, continuous monitoring of application logs for anomalous order creation patterns and restricting network exposure of the service are recommended defensive measures to reduce the attack surface.