CVE-2026-79348

Insecure Direct Object Reference in KitchenAsty Reservations API Allows Unauthorized Access to User Reservations

Published Sep 29, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in packages/server/src/controllers/reservation.controller.ts returns the record retrieved by the client-supplied identifier without comparing reservation.customerId to the authenticated principal

Analysis

Technical impact

KitchenAsty through version 0.3.0 contains an IDOR flaw in its reservations API. The GET /api/reservations/:id endpoint authenticates the caller but does not verify that the requested reservation belongs to the authenticated user or that the user has sufficient privileges. Consequently an attacker can supply any reservation identifier and receive the full reservation record, exposing potentially sensitive customer information.

Affected Systems

All installations of KitchenAsty at or before version 0.3.0 are affected because the vulnerability resides in the server components that handle reservation retrieval.

Risk and Exploitability

The vulnerability scores 4.3 on the CVSS scale, indicating moderate severity, and it is not listed in CISA’s KEV catalog. The Exploit Prediction Score is not available, but the flaw is straightforward to exploit for any authenticated user. An attacker only needs to know or guess a valid reservation ID, which can often be enumerated or discovered through trial and error, to obtain unauthorized data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a KitchenAsty release newer than 0.3.0 that includes the authorization check for reservation access.
Modify the reservations controller to compare reservation.customerId with the authenticated user’s identifier and reject access when they do not match.
Add an authorization middleware to the reservation route that verifies ownership before the handler executes.
If an upgrade is not immediately possible, monitor and log all attempted accesses to the reservation endpoint and block repeated or abnormal requests.

Generated by OpenCVE AI on September 30, 2026 at 11:05 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.199% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/mighty840/kitchenasty
https://github.com/mighty840/kitchenasty/blob/main/packages/server/src/controllers/reservation.controller.ts
https://github.com/mighty840/kitchenasty/blob/main/packages/server/src/routes/reservation.routes.ts
https://github.com/mighty840/kitchenasty/pull/43
https://github.com/mighty840/kitchenasty/security/advisories/GHSA-2w4m-hjg2-2v92

History

Sep 30, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 30, 2026 11:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Insecure Direct Object Reference in KitchenAsty Reservations API Allows Unauthorized Access to User Reservations
Weaknesses		CWE-284 CWE-639

Sep 29, 2026 8:00 PM Description updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in packages/server/src/controllers/reservation.controller.ts returns the record retrieved by the client-supplied identifier without comparing reservation.customerId to the authenticated principal
References		https://github.com/mighty840/kitchenasty https://github.com/mighty840/kitchenasty/blob/main/packages/server/src/controllers/reservation.controller.ts https://github.com/mighty840/kitchenasty/blob/main/packages/server/src/routes/reservation.routes.ts https://github.com/mighty840/kitchenasty/pull/43 https://github.com/mighty840/kitchenasty/security/advisories/GHSA-2w4m-hjg2-2v92
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N'}`