Quick answers
- Is CVE-2026-114267 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114267 being exploited in the wild.
- How severe is CVE-2026-114267?
- High severity, with a CVSS score of 7.3, published 21 October 2026.
- Which products and versions are affected?
- SourceCodester Food Order Management System 1.0.
- Is there a fix for CVE-2026-114267?
- No fixed version is recorded yet. Implement server-side authorization checks at the beginning of every administrative endpoint before processing requests. Use a centralized authentication function that verifies a valid administrative session exists and terminates execution immediately if unauthorized, rather than relying on client-side redirects.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21","note":"Vulnerability published"},{"kind":"other","at":"2026-10-21","note":"Exploit made public"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-114267 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-114267?
- Check whether you run SourceCodester Food Order Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Implement server-side authorization checks at the beginning of every administrative endpoint before processing requests. Use a centralized authentication function that verifies a valid administrative session exists and terminates execution immediately if unauthorized, rather than relying on client-side redirects.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21","note":"Vulnerability published"},{"kind":"other","at":"2026-10-21","note":"Exploit made public"}]
Technical details
Multiple administrative PHP endpoints (add_admin.php, add_food.php, delete.php, etc.) in the component fail to enforce server-side authentication or authorization checks, allowing unauthenticated remote requests to access administrative functionality. The vulnerability stems from missing authorization validation on each endpoint; although admin.php attempts session verification, it does not terminate execution before redirect, and individual endpoints lack independent checks. An attacker can directly invoke these endpoints to gain full administrative control.
Affected products
- SourceCodester Food Order Management System 1.0