CVE-2026-112825: Missing Authorization in Magepeople inc. Car Rental Manager

This vulnerability in Car Rental Manager arises from missing authorization checks due to incorrectly configured access control security levels. It affects all versions from the initial release up to version 1.5.3 inclusive. The issue allows attackers with some privileges to access sensitive information without proper authorization, impacting confidentiality but not integrity or availability. There is no indication of active exploitation in the wild. No patch or remediation details are provided in the available data.

An attacker with some level of privileges can exploit this vulnerability to gain unauthorized access to sensitive information, resulting in a confidentiality breach. There is no impact on integrity or availability. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations to ensure proper authorization enforcement. Monitor for any updates from Magepeople inc. regarding patches or mitigations.