This vulnerability (CVE-2026-28186) in themefic's Travelfic Toolkit (versions <= 1.5.1) is classified as CWE-862: Missing Authorization. It allows users with subscriber-level privileges to bypass access controls, potentially enabling unauthorized modification or disruption of system functions. The CVSS 3.1 score is 8.1 (high), reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. No known exploits are reported in the wild, and no vendor remediation or patch is currently documented.

Exploitation of this vulnerability can lead to unauthorized actions that compromise the integrity and availability of the affected system. Although confidentiality is not impacted, the ability to alter or disrupt system operations poses a significant risk to users relying on the Travelfic Toolkit. The vulnerability requires low privileges to exploit and can be triggered remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting subscriber privileges and monitoring for unusual activity related to access control bypass. No official remediation or temporary fix is currently available from the vendor.