Medium severity · published Oct 26, 2026
CVE-2026-116604
SourceCodester Online Food Ordering System delete_admin.php missing authentication
New
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Online Food Ordering System · SourceCodester
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116604
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116604
github.com
https://github.com/CyberShailendra/SourceCodesterAuthenticationonAdminDeleteEndpoints
vuldb.com
https://vuldb.com/cve/CVE-2026-116604
vuldb.com
https://vuldb.com/submit/1022963
vuldb.com
https://vuldb.com/vuln/426510
vuldb.com
https://vuldb.com/vuln/426510/cti
www.sourcecodester.com
https://www.sourcecodester.com/
More from Online Food Ordering System
7.3
CVE-2026-90855
SourceCodester/katojkalemba Online Food Ordering System order.php sql injection
7.3
CVE-2026-90854
SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection
7.3
CVE-2026-10694
SourceCodester Online Food Ordering System index.php include file inclusion
6.5
CVE-2026-116602
SourceCodester Online Food Ordering System delete.php unlink path traversal
6.1
CVE-2024-8604
SourceCodester Online Food Ordering System Create an Account Page index.php cross site scripting