Quick answers
- Is CVE-2026-14693 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14693 being exploited in the wild.
- How severe is CVE-2026-14693?
- Medium severity, with a CVSS score of 5.4, published 5 July 2026.
- Which products and versions are affected?
- SourceCodester Multi-Vendor Online Grocery Management System 1.0.
- Is there a fix for CVE-2026-14693?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14693 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-14693?
- Check whether you run SourceCodester Multi-Vendor Online Grocery Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the cancel_order function within classes/Master.php. The application accepts an order ID via POST data and executes a database UPDATE statement without verifying if the order belongs to the currently authenticated user. Because client registration is open to the public without approval, any remote attacker can create an account and manipulate the 'id' parameter to cancel arbitrary orders. The update_status function is reportedly affected by the same lack of ownership validation. No official patch is currently available; developers are advised to enforce ownership by including the session-based client_id in the SQL WHERE clause.
Affected products
- SourceCodester Multi-Vendor Online Grocery Management System 1.0
Timeline
- 2026-06-03: disclosed: Vulnerability details and PoC published on GitHub
- 2026-07-05: advisory: NVD/VulDB advisory published