CVE-2026-79348CWE-639

CVE-2026-79348

Medium · published September 30, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in packages/server/src/controllers/reservation.controller.ts returns the record retrieved by the client-supplied identifier without comparing reservation.customerId to the authenticated principal

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00199 · 9.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-30T00:17Z
References (5)
https://github.com/mighty840/kitchenasty/security/advisories/GHSA-2w4m-hjg2-2v92 · [email protected]https://github.com/mighty840/kitchenasty · [email protected]https://github.com/mighty840/kitchenasty/blob/main/packages/server/src/controllers/reservation.controller.ts · [email protected]https://github.com/mighty840/kitchenasty/blob/main/packages/server/src/routes/reservation.routes.ts · [email protected]https://github.com/mighty840/kitchenasty/pull/43 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 00:00Z
    KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API
    cvelistv5