The vulnerability resides in the OrderController.deleteOrder method of ZongXR SuperMarket. The function accepts an orderId parameter but does not verify that the caller is authenticated or authorized, allowing an attacker to delete any order simply by providing an orderId value. This flaw results in unauthorized removal of order records. Without proper authentication, the application cannot guarantee the integrity of the order database.

The affected product is ZongXR SuperMarket version 1.0.0.0, as identified by the vendor ZongXR. The issue is located in the Order Deletion Endpoint component (order/src/main/java/com/supermarket/order/controller/OrderController.java). No other products or versions are listed.

The CVSS score of 6.9 indicates a moderate impact and ease of exploitation. The EPSS value is unavailable, so the current probability of exploitation is unknown but the vulnerability has a public exploit release. It is not listed in the CISA KEV catalog. The attack can be performed remotely, so any external user who can reach the endpoint could delete arbitrary orders. As the authentication check is entirely missing, an attacker does not need to bypass any authorization controls, making the exploit straightforward once the endpoint is reachable.