The vulnerability lies in the cancel_order method of classes/Master.php in SourceCodester Multi‑Vendor Online Grocery Management System 1.0. It permits an attacker to bypass the normal authorization that limits cancellation to the order owner or an administrator, enabling the deletion of any order without permission. The flaw does not directly lead to data disclosure or server compromise, but it can disrupt business operations by removing legitimate orders. Based on the description, the conclusion that there is no direct data disclosure or server compromise is inferred, as the vulnerability wording does not explicitly mention these impacts.

Any installation of SourceCodester Multi‑Vendor Online Grocery Management System version 1.0 is affected. The flaw resides only in that precise release of the application and targets the cancel_order endpoint exposed through classes/Master.php.

The CVSS score of 5.3 places the issue in the moderate severity range, reflecting unauthorized order cancellations without direct system compromise. The EPSS score of less than 1 percent indicates a very low but non‑zero likelihood of exploitation; however, an exploit has already been published, raising immediate concern. The vulnerability is not listed in CISA’s KEV catalog. Remote exploitation is feasible via a forged HTTP request to the cancel_order endpoint. Based on the description, the likely attack vector is forging an HTTP request to the cancel_order endpoint from a remote client.