This vulnerability (CVE-2024-22298) is classified as CWE-862 (Missing Authorization) affecting the Amelia booking system by TMS. It impacts versions up to 1.0.98 and allows an attacker to access resources or perform actions without proper authorization. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official fix or patch has been documented, and the product is not a cloud service, so remediation depends on vendor updates.

An attacker can exploit this missing authorization vulnerability remotely without authentication or user interaction to gain limited access to data or functionality that should be protected. The impact is limited to confidentiality loss, with no integrity or availability effects reported. No active exploitation has been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates. Until a patch is available, restrict network exposure of the affected application where possible to reduce risk.