CVE-2026-109116: Authorization Bypass in AdithyaYelloju Restaurant-Management-System

This vulnerability in AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c involves the Order Management component's use of mysqli_query. By manipulating the ID argument, an attacker can bypass authorization checks remotely. The product lacks formal versioning, so precise affected versions cannot be determined. The vulnerability was responsibly disclosed but remains unpatched and unaddressed by the vendor. Public exploit details exist, increasing the risk of exploitation despite no confirmed in-the-wild attacks.

Successful exploitation allows remote attackers to bypass authorization controls in the Order Management component, potentially granting unauthorized access or actions within the system. This could lead to unauthorized order manipulation or data exposure related to restaurant management operations. The medium CVSS score reflects the significant but not critical impact due to the lack of privilege requirements and user interaction.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing additional access controls or network-level restrictions to limit exposure of the affected component. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.