CVE-2026-116604: SourceCodester Online Food Ordering System delete_admin.php missing authentication
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/deleteadmin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction, according to the supplied CVSS vector. An unauthenticated network-reachable instance is therefore exposed.
What is the likely impact of successful exploitation?
The vulnerable endpoint is admin/delete_admin.php, where manipulation of the ID argument can trigger an action without authentication. The provided severity data indicates impacts to integrity and availability, with no indicated confidentiality impact.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used, increasing the likelihood of attempted exploitation.