CVE-2026-54835: Unauthenticated Access Control Flaw in Five Star Restaurant Menu

Technical summary

The vulnerability is an unauthenticated broken access control issue (CWE-862) affecting Five Star Restaurant Menu up to and including version 2.5.2. The application fails to enforce proper authentication or authorization checks on sensitive endpoints, allowing an attacker to craft requests that bypass authentication requirements and modify protected resources. The CVSS 3.1 score of 7.5 (HIGH) reflects network-accessible exploitation with no user interaction required, resulting in high integrity impact but no confidentiality or availability loss.

Business impact

Restaurant operators using Five Star Restaurant Menu are exposed to data tampering that could degrade customer experience, undermine pricing controls, or damage brand reputation if menus are altered without authorization. The lack of integrity protection means legitimate business data can be corrupted by any network-capable attacker, potentially leading to operational confusion, customer complaints, and compliance issues if customer-facing information is modified.

Affected systems

Five Star Restaurant Menu versions 2.5.2 and all earlier releases are vulnerable. Organizations running this software should immediately identify deployed instances and verify their current version. The vendor product list in the source data is empty, so verify version numbers directly in your environment or contact the vendor for a complete bill of materials.

Exploitability

Exploitation requires no authentication, no special privileges, and no user interaction—only network access to the affected application. An attacker can directly interact with unprotected API or web endpoints to submit malicious requests. The straightforward attack surface and absence of authentication barriers make this a practical threat in any environment where the application is exposed to untrusted networks.

Remediation

Upgrade Five Star Restaurant Menu to a patched version beyond 2.5.2. Verify the exact version number and availability of security updates by consulting the vendor's advisory or release notes. As an interim control, restrict network access to the application using firewall rules or network segmentation to limit exposure to trusted administrative users and systems until patching is complete.

Patch guidance

Check the vendor's official security advisory or release page for the minimum patched version that addresses CVE-2026-54835. Update the application according to the vendor's deployment guidance, testing in a non-production environment first. Document the current version in your asset inventory and establish a process to track future security updates for this software.

Detection guidance

Monitor application logs and network traffic for POST, PUT, or DELETE requests to menu-related endpoints that originate from unexpected sources or lack valid authentication tokens. Look for repeated or rapid modification attempts to menu items, pricing, or configuration data. Enable audit logging on the application to capture data modifications and correlate them with source IP addresses and request timestamps to identify unauthorized changes.

Why prioritize this

This vulnerability merits high priority due to the combination of easy exploitability (no authentication required), network accessibility, and direct impact on data integrity. Any publicly exposed instance is immediately exploitable by remote attackers. The lack of controls protecting sensitive restaurant data makes this a business continuity risk that should be remediated quickly.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction needed (UI:N). The high integrity impact (I:H) indicates that attackers can modify protected data. The absence of confidentiality (C:N) and availability impact (A:N) prevents a critical rating, but the ability to tamper with business-critical menu information without authentication justifies the HIGH severity classification.

Frequently asked questions