CVE-2026-54830: Unauthenticated Access Control Vulnerability in Five Star Restaurant Reservations

Technical summary

CVE-2026-54830 is a broken access control vulnerability (CWE-862) in Five Star Restaurant Reservations affecting version 2.7.19 and earlier. The application fails to enforce authorization checks on reservation-related endpoints, allowing unauthenticated attackers to perform state-changing operations. The vulnerability has a CVSS 3.1 score of 7.5 (HIGH), with network-based attack vector, low complexity, no privilege requirements, and no user interaction needed. The flaw enables integrity compromise with no confidentiality or availability impact in the scored vector, though operational disruption may occur in practice.

Business impact

Restaurant operations relying on Five Star Reservations face immediate risk of reservation manipulation, including unauthorized cancellations, modifications to guest details, and booking interference. This undermines customer trust, disrupts seating logistics, and creates compliance concerns if guest data is altered. The unauthenticated nature means attackers do not need internal access or stolen credentials—any threat actor can exploit this remotely. Extended exploitation could result in revenue loss from canceled bookings and reputational damage.

Affected systems

Five Star Restaurant Reservations version 2.7.19 and all earlier versions are confirmed vulnerable. Organizations running this plugin or application must identify all instances and determine their version. The vendor's product listing is not yet fully enumerated in public advisory data; verify your exact version against the official Five Star Restaurant Reservations release notes and security advisories.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no special privileges, and no user interaction—only a network connection to the affected application. Attack complexity is low, meaning standard HTTP requests can trigger the flaw. The barrier to exploitation is minimal, making this an attractive target for opportunistic attackers. However, the vulnerability is not yet listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been formally confirmed by US government agencies at the time of publication.

Remediation

Upgrade Five Star Restaurant Reservations to a patched version released after 2.7.19. Consult the official vendor advisory and release notes to confirm the minimum safe version. Until patching is possible, implement network-level access controls to restrict direct access to the reservation endpoints, and review access logs for anomalous modification patterns. Web application firewalls (WAF) may provide temporary mitigation by blocking unauthorized state-changing requests, though they are not a substitute for patching.

Patch guidance

Contact Five Star Restaurant Reservations support or check their official website for security advisories and available patches. The vulnerability affects all versions up to and including 2.7.19; newer versions should contain a fix. Verify the patch version in the vendor's official documentation before deploying. Test the update in a staging environment to ensure compatibility with your restaurant's workflows and integrations before production rollout.

Detection guidance

Monitor application logs and WAF logs for unauthorized HTTP requests to reservation endpoints that originate from unauthenticated sessions or lack proper authorization tokens. Look for patterns of POST/PUT/DELETE requests to reservation resources without valid authentication headers. Correlate request source IPs and timing to identify potential automated attacks. Review recent reservation modifications for entries that do not correspond to known customer actions or staff interactions. Consider deploying intrusion detection signatures tuned to detect access control bypasses on the affected application.

Why prioritize this

Despite not being on the CISA KEV catalog, this vulnerability merits high priority because it requires no authentication to exploit and directly enables business-critical data manipulation. Any restaurant using version 2.7.19 or earlier faces immediate operational risk. The ease of exploitation combined with direct impact on core functionality (reservations) and the lack of user interaction requirements elevates this above purely confidentiality-focused flaws. Organizations should treat this as a critical patching candidate.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, low-complexity, unauthenticated attack that achieves high integrity impact. While the scored vector does not capture availability or confidentiality loss, real-world exploitation can disrupt restaurant operations and compromise guest data integrity. The absence of authentication requirements is the primary driver of exploitability. This score aligns with the practical risk posed by an easily exploitable flaw affecting core business processes.

Frequently asked questions