CVE-2026-112824: Missing Authorization in Magepeople inc. Bus Ticket Booking with Seat Reservation

This vulnerability involves missing authorization controls in the Bus Ticket Booking with Seat Reservation product by Magepeople inc., affecting all versions prior to 5.9.8. The issue arises from incorrectly configured access control security levels, which could allow an attacker without privileges to perform unauthorized actions. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with no confidentiality or availability impact but a low integrity impact. There is no information about an official fix or patch from the vendor.

An attacker can exploit the missing authorization to perform unauthorized actions that may alter data or system state, impacting the integrity of the application. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and strengthen access control configurations to ensure proper authorization enforcement.