CVE-2026-79348 describes an IDOR vulnerability in KitchenAsty through version 0.3.0. The vulnerability exists in the reservations API endpoint GET /api/reservations/:id, which applies authentication middleware but lacks authorization checks to confirm that the authenticated principal owns the requested reservation. Specifically, the getReservation handler returns reservation data based solely on the client-supplied identifier without verifying that reservation.customerId matches the authenticated user. This flaw permits unauthorized read access to reservation records of other users.

An attacker with valid authentication and limited privileges can access reservation data of other users without authorization. The impact is limited to information disclosure (confidentiality loss) as the vulnerability does not allow modification or deletion of data. The CVSS 3.1 base score is 4.3, indicating a medium severity due to low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected API endpoint or implementing additional authorization checks to ensure that the authenticated user can only access their own reservation records.