CVE-2026-105070: CWE-266 Incorrect Privilege Assignment in Dimitri Grassi Salon booking system

This vulnerability, identified as CWE-266 Incorrect Privilege Assignment, exists in the Dimitri Grassi Salon booking system versions up to and including 10.31.7. It permits unauthenticated attackers to escalate their privileges, potentially gaining unauthorized access and control over the system. The CVSS 3.1 score of 8.8 indicates a high impact with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to escalate privileges, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access to sensitive booking data, manipulation of system functions, and potential denial of service.

No patch or official remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected system and monitor for suspicious activity related to privilege escalation attempts.