{"id":"CVE-2026-116604","title":"SourceCodester Online Food Ordering System delete_admin.php missing authentication","summary":"A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","cvssSource":"cna","cwe":["CWE-306","CWE-287"],"vendor":"SourceCodester","product":"Online Food Ordering System","affected":["online_food_ordering_system 1.0"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-27T13:57:59.602416Z"},"exploitAvailable":true,"published":"2026-10-26","updated":"2026-10-27","sourceUpdated":"2026-10-27T14:15:12.149Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116604","references":[{"url":"https://vuldb.com/vuln/426510","label":"VDB-426510 | SourceCodester Online Food Ordering System delete_admin.php missing authentication"},{"url":"https://vuldb.com/vuln/426510/cti","label":"VDB-426510 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-116604","label":"CVE-2026-116604 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1022963","label":"Submit #1022963 | SourceCodester Online Food Ordering System in PHP and MySQL Source Code 1.0 Missing Authentication on Admin Delete Endpoints"},{"url":"https://github.com/CyberShailendra/SourceCodesterAuthenticationonAdminDeleteEndpoints"},{"url":"https://www.sourcecodester.com/"}],"tags":["cve.org","exploit-available"],"epss":0.00569,"epssPercentile":0.46913,"ingestedAt":"2026-10-27T16:11:59.446Z","slug":"CVE-2026-116604","body":"## Overview\n\nA vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.\n\n## Affected\n\n- `online_food_ordering_system 1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}