EUVD-2026-90473
GHSA-4h92-663f-86ww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed SuperMarket instance
-
DeliverySend unauthenticated HTTP request to deleteOrder
-
ExploitSupply arbitrary orderId parameter
-
ExecutionEndpoint skips auth check
-
PersistDelete targeted order records
-
ImpactData integrity and availability loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against a reachable deployment of ZongXR SuperMarket 1.0.0.0. The attacker only needs network access to the OrderController.deleteOrder endpoint and must supply an orderId argument; no credentials, user interaction, or non-default configuration are required (AV:N/AC:L/AT:N/PR:N/UI:N). The only real limiting factor is exposure: the product is an obscure hobby project rarely deployed in production, and the impact is confined to order-record deletion (integrity/availability), not confidentiality or code execution. |
| Impact | Signals are consistent but point to a low-to-moderate real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable, unauthenticated, remote flaw, but the vendor-assigned impact is deliberately limited to VI:L/VA:L (partial integrity and availability, no confidentiality), yielding a 6.9 medium score rather than a critical one - consistent with the CWE-306 missing-authentication condition on a single order-deletion endpoint rather than full system takeover. SSVC-style exploit maturity is E:P (Proof-of-Concept), and a public exploit is confirmed via the GitHub issue, so 'publicly available exploit code exists' - but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation, so this is POC availability, NOT confirmed in-the-wild use. The dominant mitigating factor is prevalence: ZongXR SuperMarket is an obscure GitHub project (version 1.0.0.0) with no meaningful production footprint, and the maintainer was notified via an issue report but has not responded, implying no patch. Net: a genuine, easily exploitable unauthenticated flaw, but the near-zero deployment base makes it a low operational priority for most defenders rather than a high-CVSS-but-overrated issue. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to the OrderController.deleteOrder endpoint, supplying an arbitrary orderId value. Because the endpoint performs no authentication or authorization check (CWE-306), the attacker deletes other users' orders at will, corrupting order data and degrading application availability. A public proof-of-concept is already documented in the project's GitHub issue tracker (issue #31). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated remote attackers can delete arbitrary order records in ZongXR SuperMarket 1.0.0.0 because the OrderController.deleteOrder endpoint lacks authentication checks (CWE-306). Publicly available exploit code exists (GitHub issue #31), and the project maintainer has not responded to the report. With a CVSS 4.0 score of 6.9 (medium) and an independent assessment confirming only low integrity and availability impact, the vulnerability poses a low-to-moderate risk, primarily limited by the product's rare deployment in production environments.
RemediationAI
No vendor-released patch is available at the time of analysis, as the project maintainer has not responded to the issue report (GitHub issue #31). To mitigate, implement authentication and authorization checks on the OrderController.deleteOrder endpoint (e.g., using Spring Security annotations) as the definitive fix. If immediate code changes are not possible, restrict network access to the order deletion endpoint via firewall rules or an API gateway, or disable the order deletion functionality entirely if it is not business-critical. Deploying the application behind an authenticating reverse proxy that enforces credentials for all delete requests can also help, but this adds latency and configuration complexity. Monitor logs for unauthorized deletion attempts. Given the public exploit, prioritize patching if the application is exposed. Advisory references: VulDB (https://vuldb.com/vuln/412348) and the GitHub issue (https://github.com/ZongXR/SuperMarket/issues/31).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic Missing Authentication for Critical Function (CWE-306) in a Java Spring Boot application. The OrderController.deleteOrder method in the order microservice (order/src/main/java/com/supermarket/order/controller/OrderController.java) processes an orderId parameter and deletes the corresponding order record without verifying the requester's identity or permissions. The CPE string cpe:2.3:a:zongxr:supermarket:*:*:*:*:*:*:*:* indicates that all versions of the ZongXR SuperMarket product are potentially affected, though the reported version is 1.0.0.0. Because the endpoint is exposed over the network and requires no credentials, any remote attacker who can reach the service can invoke the deletion function, leading to loss of order data (integrity and availability impact). The public exploit code in GitHub issue #31 demonstrates the attack vector.
Know when Supermarket gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote endpoint with no auth check gives AV:N/AC:L/PR:N/UI:N; order deletion damages integrity and availability (I:L/A:L) with no data disclosure (C:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Supermarket
View allMissing authentication in the ZongXR SuperMarket 1.0.0.0 order-save endpoint (OrderController.addOrder) allows unauthent
Missing authentication in the Instant Buy component of ZongXR SuperMarket 1.0.0.0 lets remote attackers invoke the start
Exploit-DB