This vulnerability in jairiidriss restaurant-website-php-mysql affects the AJAX endpoint at /admin/ajax_files, where missing authentication allows remote attackers to perform unauthorized actions. The affected code is unknown beyond this file path. The vulnerability is present up to the specified commit but no fixed version or patch is available. The project has not responded to the issue report. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

An attacker can remotely exploit the missing authentication in the AJAX endpoint to perform unauthorized actions on the affected system. This could lead to unauthorized access or manipulation of administrative functions. The impact on confidentiality, integrity, and availability is rated low, but the lack of authentication poses a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should consider restricting access to the /admin/ajax_files endpoint through network controls or web application firewalls as a temporary mitigation until an official fix is available.