The arnobt78 Hotel Booking Management System contains an information disclosure vulnerability identified as CVE-2026-6492. This vulnerability affects an unknown function in the /api/health/detailed endpoint of the Health Check component. Exploitation allows remote attackers to disclose information without requiring privileges or user interaction. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and confidentiality impact only. The product follows a rolling release approach, so no fixed or affected version ranges are specified. The vendor did not respond to early disclosure attempts, and no official patch or mitigation guidance is available. Public exploit code is known but no confirmed exploitation in the wild has been reported.

Successful exploitation results in unauthorized disclosure of information via the /api/health/detailed endpoint. There is no impact on integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, potentially exposing sensitive system or application information to attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, monitor official channels for updates. Consider restricting access to the /api/health/detailed endpoint or implementing network-level controls to limit exposure until a fix is released.