Restaurant Management System CVE-2026-103233

Requires a reachable, deployed instance of AdithyaYelloju Restaurant-Management-System (commit 7f0e7e8...) with an authenticated low-privileged account (PR:L), from which the attacker manipulates the ID argument in requests to the /admin/ Admin Area endpoint to reference objects belonging to other users. No user interaction is needed (UI:N) and the attack is remote (AV:N). Exploitation is LIMITED primarily by the requirement for valid authentication and by the vulnerable application's near-nonexistent deployment footprint; impact is confined to Low-severity confidentiality and integrity effects on individual records.

This is a low-real-risk issue despite a moderate CVSS. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 and describes a remotely reachable authorization-bypass (IDOR) in an authenticated admin area, with all three impacts rated Low. The E:P (Proof-of-Concept) exploit maturity aligns with the input signal that a public POC exists - it is linked from a GitHub issue rather than a weaponized standalone exploit, so this is 'publicly available exploit code exists,' NOT confirmed active exploitation. There is no CISA KEV listing and no EPSS score was provided; given the target is a hobby-grade GitHub project with negligible real-world deployment, mass or automated exploitation is highly unlikely. PR:L confirms an authenticated account is required, which further limits exposure. The tag 'Authentication Bypass' is imprecise: CWE-639 and the description both describe AUTHORIZATION bypass (accessing other records by manipulating the ID parameter), not authentication bypass. This is a genuine but low-priority defect - real, publicly documented, but scoped to a rarely deployed application with limited impact.

An attacker with a low-privileged account on a deployed Restaurant-Management-System instance sends a request to /admin/ while manipulating the ID parameter to reference records they do not own. Because the application fails to verify object ownership (CWE-639 IDOR), it returns or modifies another user's data. A public proof-of-concept is documented in the project's GitHub issue tracker.