Food Order Management CVE-2026-114267

Exploitation requires network reachability to the application's administrative endpoint (the 'Admin Endpoint' component), which in Food Order Management System 1.0 fails to perform an authorization check (CWE-862), permitting access without valid admin credentials. Per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) no authentication, user interaction, or special attack prerequisites are needed against the shipped code, so the primary limiting factors are practical rather than technical: the admin interface must be network-exposed, and the installation must be the vulnerable 1.0 release. The exact vulnerable function is not named in the source data, so defenders should confirm which admin route is affected from the public PoC before building detections.

Signals are modestly concordant and point to a real-but-not-urgent issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated access-control failure, but all three impact metrics are rated Low (VC:L/VI:L/VA:L) and there is no subsequent-system impact (SC:N/SI:N/SA:N), yielding a Medium 6.9 - consistent with CWE-862 (Missing Authorization) exposing an admin function rather than granting full compromise. The vector's E:P (Proof-of-Concept) matches the reported public exploit, so exploitability is credible but not confirmed active. There is no CISA KEV listing and no EPSS score was provided, so widespread automated exploitation cannot be asserted; the dominant real-world limiter is product prevalence, as SourceCodester applications are small PHP demonstration/learning projects with negligible production footprint. Net: a genuine authorization flaw with a working PoC, but the Low impact ratings plus a tiny deployment base make this a low operational priority for most enterprises despite the unauthenticated remote vector. Note that the input lacks the exact affected admin endpoint/function name and provides no EPSS value - both should be confirmed before final triage.

A remote attacker, without any credentials, sends a direct HTTP request to an administrative endpoint in Food Order Management System 1.0 that fails to enforce an authorization check, reaching admin-only functionality intended for authenticated operators. A proof-of-concept is publicly documented on GitHub, and the network vector with low attack complexity (AV:N/AC:L) means the request can be replayed trivially. Because impact is rated Low across confidentiality, integrity, and availability, the attacker gains partial unauthorized access to admin data or actions rather than full system takeover.