This vulnerability (CWE-639) in Talya Informatics Travel APPS allows an attacker to bypass authorization controls by manipulating a user-controlled key due to incorrectly configured access control security levels. It affects versions before 17.0.68 and has a CVSS 3.1 base score of 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not published a patch or official remediation at this time.

Successful exploitation could allow an unauthenticated attacker to bypass authorization mechanisms, potentially gaining unauthorized access to sensitive data and performing unauthorized actions within the Travel APPS environment. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application and monitor for suspicious activity related to authorization bypass attempts. Avoid relying on the vulnerable versions in production environments.