CVE-2026-14693 identifies an improper authorization vulnerability in SourceCodester Multi-Vendor Online Grocery Management System 1.0. The issue exists in the cancel_order function of the classes/Master.php file, where insufficient authorization checks allow remote attackers to perform unauthorized actions. The vulnerability is exploitable remotely without user interaction and requires low privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

Exploitation of this vulnerability could allow an attacker to cancel orders without proper authorization, potentially disrupting order processing and causing operational issues. The impact is limited to improper authorization with no direct indication of data disclosure or system compromise. The medium severity reflects the moderate risk posed by unauthorized order cancellations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected function where possible and monitor for suspicious activity related to order cancellations. Avoid exposing the vulnerable functionality to untrusted networks if feasible.