Logo
Retour à la veille

CVE-2026-79348

Publié : 29 septembre 2026
Modifié : 29 septembre 2026
Lien officiel NVD
Score CVSS
4.3
MEDIUM

Description détaillée

KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in packages/server/src/controllers/reservation.controller.ts returns the record retrieved by the client-supplied identifier without comparing reservation.customerId to the authenticated principal

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Références et Patchs

https://github.com/mighty840/kitchenastyhttps://github.com/mighty840/kitchenasty/blob/main/packages/server/src/controllers/reservation.controller.tshttps://github.com/mighty840/kitchenasty/blob/main/packages/server/src/routes/reservation.routes.tshttps://github.com/mighty840/kitchenasty/pull/43https://github.com/mighty840/kitchenasty/security/advisories/GHSA-2w4m-hjg2-2v92

Dernières Vulnérabilités

CVE-2026-15278

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-103047

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.

VOIR DÉTAILS

CVE-2026-103046

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.

VOIR DÉTAILS