CVE-2026-103536: ZongXR SuperMarket authentication bypass in order endpoint

CVE-2026-103536 · Severity: high · CVSS 7.3 · Published 2026-10-01

ZongXR SuperMarket is an e-commerce platform that manages customer orders and shopping carts. An unauthenticated attacker can create orders under any user's account without providing valid credentials, allowing them to inject fraudulent orders, pollute order histories, and disrupt fulfillment workflows. The vulnerability exists because the order creation endpoint accepts user IDs from untrusted client input without validating that the requester owns that account.

Technologies: ZongXR SuperMarket. Vendors: ZongXR.

Quick answers

Is CVE-2026-103536 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-103536 being exploited in the wild.
How severe is CVE-2026-103536?
High severity, with a CVSS score of 7.3, published 1 October 2026.
Which products and versions are affected?
ZongXR SuperMarket 1.0.0.0.
Is there a fix for CVE-2026-103536?
No fixed version is recorded yet. Add authentication validation to the OrderController.addOrder endpoint to verify that the requesting user session owns the userId being submitted; add /order/** to the gateway's authentication check list (custom.uri.check configuration). If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103536 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-103536?
Check whether you run ZongXR SuperMarket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Add authentication validation to the OrderController.addOrder endpoint to verify that the requesting user session owns the userId being submitted; add /order/** to the gateway's authentication check list (custom.uri.check configuration).

Technical details

A missing authentication vulnerability in the OrderController.addOrder endpoint (POST /order/manage/save) fails to validate that the requesting client owns the userId parameter in the Order object. The entire order creation call chain—from controller through service to database—uses the attacker-supplied userId for money validation and order insertion without reading any session token or performing ownership checks. The gateway configuration does not protect /order/** endpoints, exposing them to unauthenticated remote access.

Affected products

  • ZongXR SuperMarket 1.0.0.0

Timeline

  • 2026-10-01: disclosed: CVE-2026-103536 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.