This vulnerability (CVE-2026-42666) in the Dimitri Grassi Salon booking system is classified as CWE-862: Missing Authorization. It allows unauthenticated attackers to bypass access controls and gain unauthorized access to sensitive information or functionality. The affected versions are all versions up to and including 10.30.25. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The impact is high on confidentiality, with no impact on integrity or availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could lead to unauthorized disclosure of sensitive information within the salon booking system, compromising confidentiality. There is no reported impact on data integrity or system availability. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor the vendor's communications for updates. Until a patch is available, consider restricting external access to the affected system and applying compensating controls to limit unauthorized access.