CVE-2026-107416: Authorization Bypass Through User-Controlled Key in Webba Plugins Webba Booking

This vulnerability in Webba Booking allows an attacker to bypass authorization controls by exploiting incorrectly configured access control security levels via a user-controlled key. The flaw affects all versions prior to 6.5.3. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, resulting in high confidentiality impact but no integrity or availability impact.

An attacker can gain unauthorized access to sensitive information due to the authorization bypass. The confidentiality of data is compromised, but integrity and availability are not affected. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor vendor communications for updates and apply any official patches once available.