CVE-2026-114439: Missing Authentication in oretnom23 php-travel-agency-system

The vulnerability in oretnom23 php-travel-agency-system involves missing authentication controls in the Session Handler component located in admin/session.php. By manipulating the user_id argument, an attacker can bypass authentication remotely. The product uses a rolling release approach, so specific affected or fixed versions are not provided. The issue was reported early to the project, but no official fix or advisory has been published. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

An attacker can remotely bypass authentication by manipulating the user_id parameter in the session handling functionality. This could allow unauthorized access to administrative or user functions without valid credentials. The vulnerability impacts the confidentiality, integrity, and availability of the system to a limited extent as indicated by the CVSS vector. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, monitor official channels for updates. Until a fix is released, consider restricting access to the affected component or implementing additional authentication controls if possible.