# CVE-2026-114267: SourceCodester Food Order Management System missing authorization in admin endpoints

Source: https://junglewise.ai/threats/cve-2026-114267-a-vulnerability-was-detected-in-sourcecodester-food-order  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114267 · Severity: high · CVSS 7.3 · Published 2026-10-21

SourceCodester Food Order Management System contains a broken access control vulnerability in its administrative interface that allows unauthenticated attackers to directly access sensitive admin functions. An attacker can bypass authentication to create admin accounts, modify food pricing, delete data, or perform other administrative operations without logging in. This could lead to complete compromise of the application and its data.

Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-114267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114267 being exploited in the wild.

**How severe is CVE-2026-114267?** High severity, with a CVSS score of 7.3, published 21 October 2026.

**Which products and versions are affected?** SourceCodester Food Order Management System 1.0.

**Is there a fix for CVE-2026-114267?** No fixed version is recorded yet. Implement server-side authorization checks at the beginning of every administrative endpoint before processing requests. Use a centralized authentication function that verifies a valid administrative session exists and terminates execution immediately if unauthorized, rather than relying on client-side redirects.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21","note":"Vulnerability published"},{"kind":"other","at":"2026-10-21","note":"Exploit made public"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114267 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114267?** Check whether you run SourceCodester Food Order Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Implement server-side authorization checks at the beginning of every administrative endpoint before processing requests. Use a centralized authentication function that verifies a valid administrative session exists and terminates execution immediately if unauthorized, rather than relying on client-side redirects.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21","note":"Vulnerability published"},{"kind":"other","at":"2026-10-21","note":"Exploit made public"}]

## Technical details

Multiple administrative PHP endpoints (add_admin.php, add_food.php, delete.php, etc.) in the component fail to enforce server-side authentication or authorization checks, allowing unauthenticated remote requests to access administrative functionality. The vulnerability stems from missing authorization validation on each endpoint; although admin.php attempts session verification, it does not terminate execution before redirect, and individual endpoints lack independent checks. An attacker can directly invoke these endpoints to gain full administrative control.

## Affected products

- SourceCodester Food Order Management System 1.0

## References

- [https://github.com/amanaparvin123-pixel/security-research/blob/main/food-order-admin-access.md](https://github.com/amanaparvin123-pixel/security-research/blob/main/food-order-admin-access.md)
- [https://vuldb.com/cve/CVE-2026-114267](https://vuldb.com/cve/CVE-2026-114267)