The Dimitri Grassi Salon booking system contains an Incorrect Privilege Assignment vulnerability (CVE-2025-31560) affecting versions before 10.15. This vulnerability enables privilege escalation by allowing users to gain higher access rights than intended. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker with some level of access to escalate privileges, potentially leading to full control over the affected system. This includes unauthorized disclosure, modification, or destruction of data and disruption of service availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected system to trusted users only and monitor for unusual privilege escalations. Avoid granting unnecessary high privileges to users as a precaution.