2026 Unsecured super admin API — 17K orders, 883 stores
Data compromised
Customer names, phone numbers, email addresses, mailing addresses, purchase history, payment totals, product details
Technical writeup
Security researcher Eaton Zveare discovered unauthenticated super admin APIs on DavaIndia's website. Attackers could create unauthorized super admin accounts and gain full control. Exposed: ~17,000 online customer orders across 883 stores—names, phones, emails, addresses, purchase history, payment totals, product details. With super admin access: view/modify 1,500+ products, prices, prescription requirements; create discount coupons; edit pharmacist details. Vulnerability accessible since late 2024; CERT-In notified Aug 2025; fixed within weeks; public disclosure Feb 13, 2026.
Root cause
Unauthenticated super admin API endpoints; insecure admin subdomain