CVE-2026-103538 in SuperMarket
Summary
by MITRE • 10/01/2026
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The discovery of a critical security vulnerability within ZongXR SuperMarket version 1.0.0.0 highlights significant deficiencies in access control mechanisms, specifically targeting the Order Deletion Endpoint implemented via the OrderController.deleteOrder function located at order/src/main/java/com/supermarket/order/controller/OrderController.java. This flaw represents a classic case of broken object level authorization or missing authentication checks on sensitive operations. The core technical issue arises from the application's failure to validate whether the authenticated user initiating the request possesses the necessary privileges to delete the specific order identified by the orderId argument. Instead of verifying that the requester is an administrator or has explicit permission for that transaction, the system appears to rely solely on the presence of a valid session token without performing subsequent authorization checks against the resource owner identity. This architectural oversight allows any authenticated user, regardless of their role within the application hierarchy, to manipulate the orderId parameter and execute deletion commands intended only for privileged accounts or specific order owners.
From an operational perspective, this vulnerability enables remote attackers to perform unauthorized data destruction with severe consequences for business integrity and customer trust. By exploiting the missing authentication logic on the delete endpoint, malicious actors can systematically remove orders from the database, leading to significant financial losses due to unfulfilled transactions, inventory discrepancies, and potential regulatory non-compliance if order history is required for auditing purposes. The impact extends beyond immediate data loss; it compromises the availability and integrity of the service, potentially causing cascading failures in downstream systems that depend on accurate order status updates. Since the exploit has been released publicly, automated scanning tools and opportunistic attackers are likely to target instances running this specific version, increasing the urgency for remediation. The lack of response from the project maintainers following early issue reports further exacerbates the risk landscape, leaving deployed environments exposed without official patches or guidance on temporary mitigations.
This vulnerability aligns with CWE-284 Improper Access Control and specifically reflects patterns associated with ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to perform actions outside their intended scope due to flawed authorization logic rather than credential theft alone. It also touches upon CWE-639 Authorization Bypass Through User-Controlled Key, as the attacker controls the orderId input which dictates the target resource without sufficient verification of ownership or permission rights. To mitigate this risk immediately, organizations should implement strict role-based access control checks within the deleteOrder method to ensure that only users with administrative privileges can execute order deletions. Additionally, implementing object-level authorization by verifying that the authenticated user is the actual owner of the order before allowing deletion would prevent unauthorized cross-user attacks. Deploying a Web Application Firewall ruleset to monitor and block anomalous patterns of rapid order deletions or requests from non-admin roles targeting delete endpoints can provide an additional layer of defense until the underlying code is patched. Regular security audits focusing on API endpoint permissions are essential to identify similar gaps in other parts of the application architecture.