Zota Healthcare (DavaIndia)—Insecure admin APIs at DavaIndia pharmacy chain exposed ~17,000 customer orders and control of 883 stores for months
Security researcher Eaton Zveare found DavaIndia's e-commerce platform allowed unauthenticated users to create 'super admin' accounts via insecure APIs, exposing customer names, phone numbers, emails, addresses, and medication purchase histories from nearly 17,000 online orders, plus administrative control over 883 stores (pricing, prescription requirements, discount coupons). The flaw had been live since late 2024. Zota Healthcare (DavaIndia's parent) was notified via India's CERT-In in August 2025, patched the bug within weeks, but took until late November 2025 to confirm the fix, before public disclosure in February 2026.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Data Security | -against | primary | -1.00 |
| User Privacy | -against | secondary | -0.50 |
| Overall incident score = | -0.241 | ||
Score = avg(topic contributions) × significance (medium ×1) × confidence (0.64)× agency (negligent ×0.5)
Evidence (2 signals)
TechCrunch: DavaIndia exposed customer data and internal systems via insecure super-admin API
TechCrunch reported that security researcher Eaton Zveare found DavaIndia's e-commerce platform let unauthenticated users create super-admin accounts, exposing ~17,000 orders and admin control of 883 stores; CERT-In was notified in August 2025 and the bug was patched within weeks.
Security researcher's technical writeup documents DavaIndia super-admin API vulnerability
Researcher Eaton Zveare published a detailed technical account of the DavaIndia vulnerability, including how unauthenticated super-admin account creation exposed pricing controls, prescription requirements, and customer order data across the retail network.