This vulnerability (CWE-200) in VikRentCar allows unauthorized actors to access sensitive information, potentially compromising confidentiality. The CVSS 3.1 base score is 5.9, reflecting a network attack vector with high complexity and no privileges or user interaction required. The impact is limited to confidentiality with no integrity or availability impact reported. The affected versions include all versions up to 1.3.2, but no patch or official fix has been disclosed by the vendor.

Exposure of sensitive information to unauthorized actors can lead to confidentiality breaches. However, there is no indication of integrity or availability impact. No known exploitation in the wild has been reported, which may limit immediate risk but does not eliminate potential future exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor vendor communications for updates. Until a patch is released, limit exposure by restricting access to affected VikRentCar installations where possible.