−
Insecure admin APIs at DavaIndia pharmacy chain exposed ~17,000 customer orders and control of 883 stores for months
Feb 13, 2026negligent
Security researcher Eaton Zveare found DavaIndia's e-commerce platform allowed unauthenticated users to create 'super admin' accounts via insecure APIs, exposing customer names, phone numbers, emails, addresses, and medication purchase histories from nearly 17,000 online orders, plus administrative control over 883 stores (pricing, prescription requirements, discount coupons). The flaw had been live since late 2024. Zota Healthcare (DavaIndia's parent) was notified via India's CERT-In in August 2025, patched the bug within weeks, but took until late November 2025 to confirm the fix, before public disclosure in February 2026.