EUVD-2026-90476
GHSA-3c3p-fcf4-65hv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed order save endpoint
-
DeliveryCraft POST to addOrder with arbitrary userId
-
ExploitBypass absent authentication check (CWE-306)
-
ExecutionCreate/manipulate order for victim user
-
ImpactLow-impact integrity compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the ZongXR SuperMarket application's order save endpoint (OrderController.addOrder) be network-reachable by the attacker; no authentication, no privileges, and no user interaction are needed (AV:N/AC:L/PR:N/UI:N), and the flaw is present in default code because the endpoint omits an authentication check entirely (CWE-306). The attacker must be able to supply the userId argument in the request. The only practical limiting factor is exposure of an instance of this niche, non-production-grade project - there is no enterprise deployment to target at scale, and the project is unpatched/unresponsive. |
| Impact | Signals are consistent but point to a low real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable, unauthenticated, remote flaw - missing authentication (CWE-306) on the OrderController.addOrder save endpoint, where manipulating the userId argument lets an unauthenticated caller act on arbitrary users' behalf. The vendor-assigned 6.9 reflects low partial impact across all three dimensions (VC:L/VI:L/VA:L), which is typical of VulDB scoring; in practice the dominant impact is integrity (forging/creating orders tied to an arbitrary userId), so VC:L/VA:L look optimistic and a confidentiality/availability impact is not clearly established by the description. SSVC-style read: exploitation status is 'publicly available exploit code exists' (VulDB E:P, GitHub issue #32 flagged as exploit), automatable is plausible given a simple unauthenticated HTTP request, but technical impact is partial. No EPSS score and no CISA KEV entry are provided, so there is no evidence of active exploitation - only a public PoC. The overriding mitigating factor is prevalence: this is an obscure single-author GitHub project (ZongXR/SuperMarket) with no meaningful production footprint, and the project has not responded to the report, so it is effectively unpatched. Net: low-priority despite an unauthenticated-remote vector, because the affected software is not deployed at scale. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP POST to the order save endpoint (OrderController.addOrder) with an arbitrary userId value, causing the application to create or manipulate an order attributed to another user without any authentication check. A public exploit reference exists (GitHub issue #32, flagged as exploit by VulDB), lowering the skill needed. Because the vector is network-based with low complexity and no privileges (AV:N/AC:L/PR:N/UI:N), the request can be replayed remotely against any exposed instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Missing authentication in the ZongXR SuperMarket 1.0.0.0 order-save endpoint (OrderController.addOrder) allows unauthenticated remote attackers to submit order actions while passing an arbitrary userId argument, letting them act on behalf of other accounts without any credentials. The root cause is CWE-306: the handler performs no authentication check at all, so the caller-supplied userId is implicitly trusted. Publicly available exploit code exists (documented in the project's own GitHub issue #32), but real-world priority is low because SuperMarket is a niche, non-production Java project with no large-scale enterprise deployment footprint - the practical limit is whether an instance is network-reachable, and no privileges or user interaction are required (CVSS:4.0 PR:N/UI:N; our assessment scores it AV:N/AC:L/PR:N/UI:N with limited integrity impact, C:N/I:L/A:N).
RemediationAI
No vendor-released patch identified at time of analysis: the project was notified through issue #32 (https://github.com/ZongXR/SuperMarket/issues/32) and has not responded, so no fixed version number can be cited and none should be assumed. Until the maintainer ships a fix, the effective mitigation is to close the unauthenticated path: add an authentication filter or interceptor covering the order controller's endpoints (for example a Spring Security chain matching the order service paths) and change addOrder to derive the acting user from the authenticated principal rather than trusting the request-supplied userId - the trade-off is that any client currently posting orders anonymously will break until it authenticates, which is the intended behavior for this endpoint. If the instance is not meant to be public, bind it to localhost or a private interface, or place it behind a reverse proxy that enforces authentication for POST requests to the order save endpoint; this blocks remote exploitation but also blocks legitimate remote users and does nothing if the attacker already has network access to the back end. A WAF or proxy rule rejecting unauthenticated POSTs to the addOrder path can be a stopgap, with the caveat that path-based rules are trivially bypassed if routes change and may generate false positives. Because exploit code is public, also monitor order records and application logs for order creation attributed to unexpected userId values, and track the GitHub issue plus the VulDB advisories (https://vuldb.com/vuln/412347) for a maintainer fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is a Java web controller, order/src/main/java/com/supermarket/order/controller/OrderController.java, in a small Spring-style supermarket application whose order module exposes an HTTP endpoint that persists orders. The defect class is CWE-306 (Missing Authentication for Critical Function): the addOrder handler has no authentication or authorization guard, no security filter/interceptor covering the path, and no derivation of identity from a session or token. Instead of reading the acting user from an authenticated security context, the handler accepts the userId argument straight from the request, which is also a broken-object-level-authorization/IDOR pattern - the server has no way to distinguish the caller from the account it names. Because the handler is reachable over HTTP with no credentials and no interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, E:P for the public proof-of-concept), any exposed instance is directly writable. The CPE entry cpe:2.3:a:zongxr:supermarket:*:*:*:*:*:*:*:* uses a wildcard version, meaning the vendor has not published a fixed version and the affected range covers the released 1.0.0.0 codebase as distributed in the ZongXR/SuperMarket repository.
Know when Supermarket gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote request to an endpoint lacking auth (AV:N/AC:L/PR:N/UI:N); dominant impact is forging orders for arbitrary userId, so I:L with C/A not clearly established.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Supermarket
View allUnauthenticated remote attackers can delete arbitrary order records in ZongXR SuperMarket 1.0.0.0 because the OrderContr
Missing authentication in the Instant Buy component of ZongXR SuperMarket 1.0.0.0 lets remote attackers invoke the start
Exploit-DB