Quick answers
- Is CVE-2026-116604 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116604 being exploited in the wild.
- How severe is CVE-2026-116604?
- Medium severity, with a CVSS score of 6.5, published 27 October 2026.
- Which products and versions are affected?
- SourceCodester Online Food Ordering System 1.0.
- Is there a fix for CVE-2026-116604?
- No fixed version is recorded yet. Include user_logged.php at the top of all admin action scripts before any database operation, and add exit() after the redirect in user_logged.php to prevent continued script execution for unauthenticated users. Additionally, apply prepared statements and parameter binding for all database queries.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-116604 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-116604?
- Check whether you run SourceCodester Online Food Ordering System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Include user_logged.php at the top of all admin action scripts before any database operation, and add exit() after the redirect in user_logged.php to prevent continued script execution for unauthenticated users. Additionally, apply prepared statements and parameter binding for all database queries.</anigation> </invoke>
Technical details
The application's admin delete endpoints (admin/delete_admin.php, admin/delete.php, admin/delete_category.php) perform database deletions without verifying user authentication, implementing only a database connection include but missing a session check. An unauthenticated attacker can craft a network request with a target ID parameter to delete arbitrary admin accounts or records. The vulnerability stems from missing include of the user_logged.php authentication guard and lack of $_SESSION validation before executing DELETE queries.
Affected products
- SourceCodester Online Food Ordering System 1.0
Timeline
- 2026-10-27: disclosed: CVE-2026-116604 published