DavaIndia Pharmacy Flaw Exposed Sensitive Customer Data, Allowed Unauthorized "Super Admin" Access A critical security vulnerability in DavaIndia Pharmacy, the pharmacy arm of Zota Healthcare with over 2,300 stores across India, allowed unauthenticated users to create "super admin" accounts with full system privileges. The flaw, introduced in late 2024, exposed highly sensitive customer data tied to nearly 17,000 online orders across 800+ stores, including health conditions, medications, personal details, and purchase histories. Security researcher Eaton Zveare discovered the bug, which enabled attackers to: - Access and exfiltrate customer data (names, phone numbers, emails, addresses, and purchased products). - Tamper with product listings, including modifying prices and prescription requirements. - Create unauthorized discounts, coupons, and alter administrative controls. Zveare described the exposed data as potentially "private and even embarrassing" due to the nature of pharmacy purchases. While no evidence suggests malicious exploitation, the flaw remained unpatched until mid-September 2025, following Zveare’s responsible disclosure to CERT-In (India’s national cybersecurity agency) in August 2025. DavaIndia confirmed the fix in late November 2025, though no customer action such as password resets was required, as payment data and other secrets remained secure. The incident highlights risks in handling sensitive health-related data, particularly in large-scale digital pharmacy platforms.