This vulnerability, identified as CVE-2026-28188, affects themefic Hydra Booking versions up to 1.2.2 and is categorized as CWE-862 Missing Authorization. It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized information disclosure, modification, or disruption of availability. The CVSS 3.1 base score is 7.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Exploitation of this vulnerability could allow unauthenticated attackers to access or manipulate restricted resources or functions within the affected Hydra Booking application, potentially leading to information disclosure, data integrity issues, and service disruption. The impact affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.