CVE-2026-103536: ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely by manipulating the userId argument sent to the save endpoint handled by OrderController.addOrder. No authentication or user interaction is required.
Who is exposed?
Deployments of ZongXR Supermarket 1.0.0.0 that expose the affected order save endpoint are exposed to remote attack. The available information identifies OrderController.addOrder as the affected function.
Is public exploit code available?
Yes. The exploit is publicly available, increasing the likelihood that the vulnerability may be used.
Has a vendor fix been reported?
No vendor response or fix is reported in the available information. The project was notified through an issue report but had not responded at the time of publication.