CVE-2026-42670: Missing Authorization in Five Star Restaurant Reservations – Data Exposure Risk

Technical summary

This vulnerability stems from a failure to properly enforce authorization checks (CWE-862) in Five Star Restaurant Reservations. The system does not adequately validate whether a user has permission to access protected resources before granting access. An attacker can send network requests to affected endpoints without authentication (PR:N) and retrieve high-confidence information (C:H). The attack is simple to execute (AC:L) and requires no user interaction. All versions through 2.7.14 are affected.

Business impact

For restaurants relying on Five Star Restaurant Reservations, this vulnerability exposes customer reservation data, contact information, and potentially payment details to unauthorized access. This creates compliance exposure under data protection regulations, erodes customer trust, and may trigger breach notification obligations. Competitive disadvantage and reputational harm are likely if exploited at scale.

Affected systems

Five Star Restaurant Reservations by Etoile Web Design Incorporated versions 2.7.14 and earlier are vulnerable. Organizations using this reservation management platform should immediately audit their deployment and check their current version.

Exploitability

This vulnerability is readily exploitable. No authentication or privileges are required, and the attack can be conducted over the network with minimal complexity. An attacker with basic reconnaissance skills can identify and access unprotected endpoints. However, the vulnerability has not yet been added to the CISA KEV catalog, meaning active exploitation in the wild has not been broadly confirmed; this does not reduce its severity.

Remediation

Upgrade Five Star Restaurant Reservations to a patched version released by Etoile Web Design Incorporated. Verify the vendor advisory for the specific build that remediates CWE-862 authorization issues. As an interim measure, implement network-level access controls and Web Application Firewall (WAF) rules to restrict unauthenticated access to reservation endpoints. Review and restrict API access permissions.

Patch guidance

Contact Etoile Web Design Incorporated or consult their security advisory to identify the minimum version that resolves this authorization vulnerability. Test patches in a staging environment before production deployment to ensure compatibility with your restaurant operations. Prioritize this as a critical update given the ease of exploitation and sensitivity of reservation data.

Detection guidance

Monitor logs for unauthenticated requests to reservation endpoints and unusual data access patterns. Look for API calls from sources without valid session tokens or authorization headers. Deploy network monitoring to detect reconnaissance attempts targeting reservation system endpoints. Consider implementing behavioral analytics to identify suspicious bulk data retrieval.

Why prioritize this

A CVSS 7.5 HIGH severity vulnerability with zero authentication barriers and direct confidentiality impact warrants immediate attention. The combination of network-exploitability, zero user interaction, and data sensitivity makes this a priority for remediation before widespread awareness. Although not yet in the KEV catalog, the attack surface is significant.

Risk score, explained

The 7.5 CVSS 3.1 score reflects a high-severity flaw: remote, unauthenticated access (AV:N, PR:N, UI:N) with no complexity barrier (AC:L) yields direct confidentiality impact (C:H) but no integrity or availability compromise. This is a classic data-exposure vulnerability that rewards quick remediation.

Frequently asked questions