This vulnerability (CVE-2026-40768) is classified as CWE-639, indicating an authorization bypass through user-controlled keys in the Dimitri Grassi Salon booking system. The issue allows unauthenticated attackers to exploit insecure direct object references, potentially accessing or manipulating data they should not be authorized to. The affected versions are all versions up to and including 10.30.24. The CVSS 3.1 base score is 7.3, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability can lead to unauthorized disclosure, modification, or deletion of data within the affected salon booking system. Since no authentication is required, attackers can bypass authorization controls, potentially impacting the confidentiality, integrity, and availability of the system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users of the Dimitri Grassi Salon booking system should monitor vendor communications for updates and apply patches once available.