Is CVE-2026-103233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103233 being exploited in the wild.

How severe is CVE-2026-103233?

Medium severity, with a CVSS score of 6.3, published 30 September 2026.

Which products and versions are affected?

AdithyaYelloju Restaurant Management System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.

Is there a fix for CVE-2026-103233?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103233 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103233?

Check whether you run AdithyaYelloju Restaurant Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103233: AdithyaYelloju Restaurant-Management-System authorization bypass in admin panel

CVE-2026-103233 · Severity: medium · CVSS 6.3 · Published 2026-09-30

The Restaurant-Management-System is a web-based restaurant ordering and administration platform. A critical authorization bypass vulnerability allows any registered user—or even unauthenticated visitors in some cases—to access and modify admin functions including food menus, tables, and user accounts, as well as read plaintext user passwords. An attacker can register a free account and gain full administrative control over the restaurant system without needing legitimate admin credentials.

Technologies: AdithyaYelloju Restaurant Management System. Vendors: AdithyaYelloju.

Quick answers

Is CVE-2026-103233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103233 being exploited in the wild.
How severe is CVE-2026-103233?: Medium severity, with a CVSS score of 6.3, published 30 September 2026.
Which products and versions are affected?: AdithyaYelloju Restaurant Management System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.
Is there a fix for CVE-2026-103233?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103233 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103233?: Check whether you run AdithyaYelloju Restaurant Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The admin panel enforces access control only by checking isset($_SESSION['user']), which is set identically for both regular users and administrators, with no role-based differentiation. Several admin pages skip session_start() entirely and run completely unauthenticated. Attackers can pass ID parameters to delete, approve, or modify arbitrary rows in the database (delete_user.php, delete1.php, add_menu.php, etc.) without ownership validation or CSRF protection, exposing sensitive operations including user data with plaintext passwords.

Affected products

AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c

Timeline

2026-09-30: disclosed: Vulnerability disclosed publicly; exploit available
2026-09-01: other: Issue reported by ThanatosXingYu; no vendor response as of publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.