In early 2026, security researchers publicly disclosed a critical vulnerability in the online infrastructure of DavaIndia Pharmacy, a major retail pharmacy chain operated by Zota Healthcare and one of India’s largest private generic medicine distributors. This incident illustrates how simple architectural oversights can lead to total administrative compromise—exposing sensitive data and internal controls across hundreds of store systems.

The Discovery: Insecure Admin APIs and Authentication Gaps

The core issue at the heart of the DavaIndia incident was insecure administrative APIs that were not protected by proper authentication mechanisms. While exploring the company’s web platform, security researcher Eaton Zveare identified an admin subdomain and a “forgot password” workflow that referenced super-admin API endpoints—despite these endpoints being accessible without legitimate credentials.

These APIs returned lists of high-privileged users and allowed certain operations without validating the requester’s identity. In particular:

• Unauthenticated GET requests could enumerate existing super-admin users.
• Unprotected POST endpoints responded to API calls that allowed creation of new super-admin accounts.
• The password reset endpoint for these accounts also lacked proper verification, allowing the attacker to set their own credentials.

By combining these factors, the researcher was able to create a new super administrator account and log in with full administrative privileges—without ever authenticating in a legitimate way.

What Total Admin Access Really Means

Once inside, a super administrator could control nearly every aspect of the e-commerce platform, including:

Backend Controls

• View and edit records for hundreds of store locations connected to the online system.
• Modify or delete product listings, descriptions, and prices—including more than 1,500 products in the online catalog.
• Alter inventory levels and distribution data, affecting stock management.

Sensitive Customer and Order Data

• Access personal data tied to nearly 17,000 online orders, including names, email addresses, phone numbers, physical addresses, and purchase histories.
• Because these were pharmacy orders, data exposure included health-related purchasing behavior—a category of sensitive personal information that deserves high safeguards.

Policy and Compliance Controls

• Generate unlimited coupon codes (including ones with 100% discount), meaning financial risk and potential for fraud.
• Control whether certain medicines required prescriptions—effectively bypassing clinical and legal checks if misused.
• Modify site content, such as marketing videos or homepage components, with potential for defacement or misinformation.

In a demo, the researcher created valid platform coupons and adjusted settings to show how prescription flags could theoretically be toggled off for restricted drugs—highlighting real operational risks beyond mere data leakage.

Root Causes: Why This Was Possible

From a technical standpoint, several fundamental security failures enabled total compromise:

Unauthenticated APIs

APIs meant for internal use were exposed to the public internet without requiring authentication or access tokens. Modern web security best practice mandates that administrative controls be safeguarded with strong authentication (e.g., OAuth 2.0, JWT) and authorization checks before executing any privileged operation.

Unsafe Error Feedback

Instead of rejecting unauthorized API calls silently, the platform returned detailed error messages and parameter hints that guided the researcher on how to structure valid requests. This feedback leakage significantly lowered the effort required to reverse-engineer administrative operations.

Client-Side Exposure

Because the platform was built using client-heavy frameworks like Next.js, sensitive API endpoints and labels were included in client code and browser tooling, allowing an attacker to discover endpoints that normally would be hidden server-side.

Taken together, these issues created an attack surface that fundamentally violated the principle of least privilege, where admin paths must never be discoverable or callable by unauthenticated actors.

Timeline of Discovery and Remediation

The vulnerability timeline illustrates the lag between discovery and corporate closure:

1. August 20, 2025 — Zveare reported the issue to India’s Computer Emergency Response Team (CERT-IN).
2. Mid-September 2025 — The company patched the faulty APIs.
3. Late November 2025 — Official confirmation of remediation was provided to CERT-IN.
4. February 13, 2026 — The full detailed disclosure was published.

Notably, there is no public evidence the vulnerability was exploited before it was fixed—but the long window between patch deployment and official acknowledgment raised compliance questions, particularly under India’s evolving data protection regulations.

Broader Implications and Technical Takeaways

This incident provides several key lessons for developers, security teams, and platform architects:

Authentication Enforcement Is Mandatory

Administrative endpoints must never be reachable without robust authentication. For APIs handling patient data, regulatory compliance often requires multi-factor authentication, token expiration, and strict role-based access control.

Don’t Trust Client Code

Never embed internal API paths or sensitive functionality references in client-side code. Use server-side routes or proxies, and obfuscate or restrict administrative endpoints through network segmentation and firewall rules.

Regular Penetration Testing and Audits

Continuous security testing—internal and third-party penetration testing—can catch exposed endpoints before they are live. Automated API scanning tools can detect unauthenticated paths.

Monitor and Log Privileged Operations

Comprehensive audit trails for admin operations allow forensic verification of unauthorized access and support regulatory reporting obligations.

Prepare for Regulatory Compliance

With India’s Digital Personal Data Protection Act and related breach notification frameworks now in force, companies handling health data must adopt proactive security practices and report vulnerabilities within tight deadlines.

Conclusion

The DavaIndia Pharmacy incident demonstrates that digital transformation in healthcare is fraught with risk when security fundamentals are not followed. Healthcare platforms deal with extremely sensitive data and require defensive architectures far beyond basic consumer e-commerce practices.

What began as an insecure API configuration escalated into a full-blown administrative compromise scenario, exposing customer information and backend controls alike. While this case appears to have been responsibly disclosed and remediated before exploitation, it serves as a cautionary tale for any organization building systems that touch health, financial, or personal data.

In an era where digital and physical healthcare increasingly converge, security must be a design priority—not an afterthought.