This vulnerability in the Dimitri Grassi Salon booking system allows an attacker with some level of privileges to bypass authorization mechanisms by controlling a key used in the authorization process. It affects all versions up to and including 10.9. The CVSS vector indicates the attack can be performed remotely with low complexity and no user interaction, requiring some privileges but resulting in limited impact to integrity without affecting confidentiality or availability.

An attacker with limited privileges can bypass authorization controls, potentially allowing unauthorized actions that impact the integrity of the system. There is no impact on confidentiality or availability according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges where possible to minimize risk. Monitor vendor channels for updates and apply patches promptly once available.