This vulnerability in shiptrack's Booking Calendar and Notification component arises from missing authorization checks, which means that users may perform actions or access resources without proper permissions. The affected versions include all versions up to and including 4.0.3. The CVSS score of 6.5 reflects a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity and availability, with no confidentiality impact reported. There is no indication of an official patch or vendor advisory at this time.

Exploitation of this vulnerability can lead to unauthorized modification or disruption of booking calendar and notification functionalities, potentially affecting the integrity and availability of these services. Confidential data exposure is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Booking Calendar and Notification component to trusted users only and monitor for unusual activity related to access control. Avoid exposing the affected versions to untrusted networks where possible.