The vulnerability resides in the OrderController.addOrder method of the ZongXR Supermarket application. By manipulating the userId argument, an attacker can trigger the addOrder function without being authenticated, enabling the creation of orders in the system. This flaw permits unauthorized users to place orders, potentially leading to fraudulent transactions and compromise of sensitive store data.

The affected product is ZongXR Supermarket, released in version 1.0.0.0. Users running this exact version are exposed, especially those who rely on the public save endpoint for order processing.

With a CVSS score of 6.9, the flaw represents a moderate severity weakness. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can exploit it remotely, and publicly available proof‑of‑concept code suggests that exploitation is feasible without special privileges. Given the authentication bypass nature of the flaw, the impact is significant for any user able to reach the endpoint.