This vulnerability involves missing authorization in the raratheme Spa and Salon software up to version 1.3.2, allowing exploitation of incorrectly configured access control security levels. The CVSS score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss. No known exploits are reported in the wild, and no patch or vendor advisory is provided.

The impact is limited to integrity, meaning an attacker could potentially modify data or perform unauthorized actions within the application. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in the affected versions to prevent unauthorized access. Monitor vendor channels for updates or patches addressing this vulnerability.