The vulnerability CVE-2026-32346 affects the raratheme Travel Agency software up to version 1.5.5. It is caused by missing authorization checks, resulting in incorrectly configured access control security levels. This allows unauthenticated attackers to perform actions that should require authorization, impacting the integrity of the system. The CVSS 3.1 base score is 5.3 (medium), with attack vector network, low attack complexity, no privileges required, no user interaction, and no confidentiality or availability impact.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions that modify data or system state, impacting the integrity of the Travel Agency application. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and strengthen access control configurations in the Travel Agency application to ensure proper authorization enforcement. Monitor vendor channels for updates or patches addressing this issue.