The vulnerability CVE-2026-39652 affects iGMS Direct Booking versions up to 1.3 and is characterized by missing authorization checks. This misconfiguration permits unauthorized users to perform actions that should require proper access control, leading to integrity impact without affecting confidentiality or availability. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. No official remediation or patch has been published, and the product is not a cloud service, so remediation depends on vendor updates.

Exploitation of this vulnerability can result in unauthorized modification of data within the iGMS Direct Booking system due to missing authorization controls. There is no impact on confidentiality or availability reported. The vulnerability does not require privileges or user interaction to exploit, increasing the risk of unauthorized integrity changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation level has been published, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected system and reviewing access control configurations may help reduce risk.