# CVE-2026-14693: SourceCodester Multi-Vendor Online Grocery Management System IDOR in cancel_order

Source: https://junglewise.ai/threats/cve-2026-14693-sourcecodester-multi-vendor-online-grocery-management-system-idor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-14693 · Severity: medium · CVSS 5.4 · Published 2026-07-05

SourceCodester Multi-Vendor Online Grocery Management System is a web application for managing grocery sales. A security flaw allows any registered customer to cancel or modify the status of orders belonging to other users. This could lead to business disruption, targeted sabotage of competitors, and loss of customer trust.

Technologies: [SourceCodester Multi-Vendor Online Grocery Management System](https://junglewise.ai/threats/technologies/multi-vendor-online-grocery-management-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-14693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14693 being exploited in the wild.

**How severe is CVE-2026-14693?** Medium severity, with a CVSS score of 5.4, published 5 July 2026.

**Which products and versions are affected?** SourceCodester Multi-Vendor Online Grocery Management System 1.0.

**Is there a fix for CVE-2026-14693?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14693 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14693?** Check whether you run SourceCodester Multi-Vendor Online Grocery Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the cancel_order function within classes/Master.php. The application accepts an order ID via POST data and executes a database UPDATE statement without verifying if the order belongs to the currently authenticated user. Because client registration is open to the public without approval, any remote attacker can create an account and manipulate the 'id' parameter to cancel arbitrary orders. The update_status function is reportedly affected by the same lack of ownership validation. No official patch is currently available; developers are advised to enforce ownership by including the session-based client_id in the SQL WHERE clause.

## Affected products

- SourceCodester Multi-Vendor Online Grocery Management System 1.0

## Timeline

- 2026-06-03: disclosed: Vulnerability details and PoC published on GitHub
- 2026-07-05: advisory: NVD/VulDB advisory published

## References

- [https://github.com/lee945/cve/issues/4](https://github.com/lee945/cve/issues/4)
- [https://vuldb.com/cve/CVE-2026-14693](https://vuldb.com/cve/CVE-2026-14693)
- [https://vuldb.com/submit/846833](https://vuldb.com/submit/846833)
- [https://vuldb.com/vuln/376289](https://vuldb.com/vuln/376289)
- [https://vuldb.com/vuln/376289/cti](https://vuldb.com/vuln/376289/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Multi-Vendor Online Grocery Management System SQL injection in Registration Handler](https://junglewise.ai/threats/cve-2026-14695-sourcecodester-multi-vendor-online-grocery-management-system-sql)
- [SourceCodester Multi-Vendor Online Grocery Management System SQL injection in cancel_order](https://junglewise.ai/threats/cve-2026-14694-sourcecodester-multi-vendor-online-grocery-management-system-sql)
- [SourceCodester Multi-Vendor Online Grocery Management System SQL injection in save_shop_type](https://junglewise.ai/threats/cve-2026-14692-sourcecodester-multi-vendor-online-grocery-management-system-sql)
- [SourceCodester Multi-Vendor Online Grocery Management System code injection in SystemSettings](https://junglewise.ai/threats/cve-2026-14691-sourcecodester-multi-vendor-online-grocery-management-system-code)
- [SourceCodester Multi-Vendor Online Grocery Management System improper authorization in save_users](https://junglewise.ai/threats/cve-2026-14690-sourcecodester-multi-vendor-online-grocery-management-system)