KitchenAsty through version 0.3.0 contains an IDOR flaw in its reservations API. The GET /api/reservations/:id endpoint authenticates the caller but does not verify that the requested reservation belongs to the authenticated user or that the user has sufficient privileges. Consequently an attacker can supply any reservation identifier and receive the full reservation record, exposing potentially sensitive customer information.

All installations of KitchenAsty at or before version 0.3.0 are affected because the vulnerability resides in the server components that handle reservation retrieval.

The vulnerability scores 4.3 on the CVSS scale, indicating moderate severity, and it is not listed in CISA’s KEV catalog. The Exploit Prediction Score is not available, but the flaw is straightforward to exploit for any authenticated user. An attacker only needs to know or guess a valid reservation ID, which can often be enumerated or discovered through trial and error, to obtain unauthorized data.