Restaurant Management System CVE-2026-109116

No authentication or user interaction is required (CVSS PR:N/UI:N): a remote attacker directly manipulates the user-controlled 'ID' argument handled by mysqli_query in the Order Management component to reference objects belonging to other users (classic IDOR/CWE-639). The concrete prerequisite is a reachable, running instance of the Restaurant-Management-System web application exposing the Order Management endpoint. Limiting factors: impact is scoped to individual order records (Low confidentiality/integrity/availability, no scope change), and real-world exposure is constrained by the product's negligible deployment base rather than by any technical access barrier.

This is an authorization bypass (CWE-639, insecure direct object reference) in the Order Management component, where manipulating a user-controlled 'ID' argument passed to mysqli_query lets an attacker access or act on records belonging to other users. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation, but all impact metrics are Low (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N), yielding a moderate 6.9 score rather than critical - consistent with an IDOR that leaks or tampers with individual order records rather than granting full system compromise. Exploit maturity is E:P (proof-of-concept), matching the publicly disclosed POC. No EPSS score and no CISA KEV entry are provided, and there is no evidence of active exploitation - only a public POC. Net real-world priority is LOW-to-MODERATE: although exploitation is trivial and unauthenticated, the affected software is an obscure, unversioned hobby/educational GitHub project with negligible production footprint, and the project maintainer has not responded to the report, so no patch exists. EPSS is absent (not a defect - just unavailable), so probabilistic exploitation likelihood cannot be quantified from the input.

A remote, unauthenticated attacker sends a request to the Order Management functionality while tampering with the 'ID' parameter, which is passed directly into a mysqli_query call. By incrementing or substituting ID values, the attacker references order records they do not own, bypassing authorization checks to read or manipulate another user's orders. A proof-of-concept has been publicly disclosed via the project's GitHub issue tracker, lowering the effort required to reproduce the attack.