The vulnerability identified as CVE-2025-63001 affects nicdark Hotel Booking software versions up to 3.8. It is caused by missing authorization controls, which means that certain actions or resources may be accessible without proper permission checks. This incorrect configuration of access control security levels can be exploited remotely without authentication, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The impact is limited to integrity, with no confidentiality or availability impact noted.

Exploitation of this vulnerability could allow an unauthenticated attacker to perform unauthorized actions that modify data or system state, affecting the integrity of the Hotel Booking application. There is no indication of confidentiality or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the affected application and reviewing access control configurations may help reduce risk.