This vulnerability in the DOTonPAPER Pinpoint Booking System arises from missing authorization controls, meaning that certain actions or resources may be accessible without proper permission checks. It affects all versions up to and including 2.9.9.6.5. The issue stems from incorrectly configured access control security levels, which could allow an attacker to perform unauthorized operations that impact the integrity of the system's data. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, but with no confidentiality or availability impact, only integrity impact.

The vulnerability allows unauthorized modification or manipulation of data within the booking system due to missing authorization checks. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed. The medium severity rating reflects the potential for integrity compromise without further escalation or system disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor DOTonPAPER communications for updates. Until a fix is available, restrict access to the affected system to trusted users and networks to reduce exposure to unauthorized access attempts.