ZongXR SuperMarket CVE-2026-103539

Requires network access to a running ZongXR SuperMarket 1.0.0.0 instance with the Instant Buy component reachable; the attacker sends a request to the startBuy endpoint and manipulates the Username argument to exploit the missing authentication check (CWE-306). No user interaction is required. The principal limiting factor is deployment: this is an obscure hobby/open-source project rarely, if ever, exposed in production. The authentication prerequisite is ambiguous - the CWE and description imply no valid credentials are needed, but the vendor vector encodes low-privilege access (PR:L), so defenders should treat the auth requirement as unconfirmed.

This is a low-real-risk issue despite a publicly available exploit. The CVSS 4.0 base score is only 2.1, reflecting minimal impact (VC:N/VI:L/VA:L) - no confidentiality loss and only limited integrity/availability effect. Exploitation status: publicly available exploit code exists (a GitHub issue PoC), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the PoC signal and the low impact point toward opportunistic/low-value abuse rather than a priority threat. A key conflict exists in the auth signals: the CWE is CWE-306 (Missing Authentication) and the description says manipulating the Username argument 'can lead to missing authentication,' which implies no valid credentials are needed (PR:N), yet the vendor vector encodes PR:L - verify with the source whether any prior session is actually required. The overriding mitigating factor is prevalence: the affected product (ZongXR/SuperMarket) is an obscure open-source GitHub project with no meaningful production footprint, and the vendor has not responded to the issue report, so no patch exists but also few if any real deployments are exposed.

A remote attacker targets an exposed instance of ZongXR SuperMarket and sends a crafted request to the Instant Buy startBuy endpoint, manipulating the Username argument to act as or on behalf of another user without proper authentication. Public proof-of-concept exists in the project's GitHub issue tracker (issue #30), lowering the effort to reproduce, though the realistic impact is limited to unauthorized purchase/instant-buy actions (integrity/availability, VI:L/VA:L).