The vulnerability identified as CVE-2025-22670 affects VikBooking Hotel Booking Engine & PMS versions up to 1.7.2. It is caused by missing authorization checks, which means that the system incorrectly configures access control security levels, allowing unauthorized users to perform actions they should not be permitted to. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but integrity and availability impacts rated as low and high respectively. No patch or official fix information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized actions within the VikBooking system, potentially impacting the integrity and availability of the service. There is no indication of confidentiality impact. The vulnerability does not require privileges or user interaction to exploit and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the VikBooking system to trusted users and networks only. Monitor for unusual activity related to access control bypass attempts. Avoid exposing the affected versions to untrusted networks.