Authorization Bypass in Restaurant-Management-System via ID Manipulation

Executive Summary

CVE-2026-109116 is an Insecure Direct Object Reference (IDOR) and authorization bypass flaw in the AdithyaYelloju Restaurant-Management-System. It allows attackers to manipulate the ID argument in functions like mysqli_query to bypass authorization checks. This enables unauthorized users to cancel, delete, or modify orders, bookings, menu items, or user accounts belonging to others by directly referencing database IDs in requests.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to state-changing endpoints like cancel, delete, or approve actions in the Restaurant Management System. Look for requests with id parameters that modify records not owned by the requester. Review logs for suspicious SQL queries or direct object references without session validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to remotely delete or alter your orders, bookings, or account details without permission. They can also modify menu items or user accounts, leading to data loss, financial fraud, or service disruption. Since the system lacks proper access controls, even anonymous users can exploit this issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for access controls and data integrity. GDPR mandates strict authorization checks to protect personal data, while HIPAA requires safeguards to prevent unauthorized modifications to health-related records. Exploits could lead to unauthorized data exposure or tampering, resulting in non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Implement session and role-based access controls to verify ownership before processing id parameters. Add input validation to ensure users can only modify their own records. Disable or restrict anonymous access to sensitive endpoints. Monitor for unusual activity in order management functions.

Useful 0 Not Useful 0