This vulnerability (CWE-862) in Themefic Hydra Booking involves missing authorization checks, which means the application does not properly enforce access control for certain functions or resources. As a result, unauthorized users may gain access to restricted features or data. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with low complexity, and impacts confidentiality, integrity, and availability to a low degree. The affected versions include all versions up to 1.1.41. No patch or official fix has been documented yet.

Exploitation of this vulnerability could allow an attacker to bypass access controls and perform unauthorized actions or access sensitive information within the Hydra Booking application. The impact affects confidentiality, integrity, and availability, but the exact scope depends on the specific access controls misconfigured. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review and tighten access control configurations in their Hydra Booking deployments to minimize exposure. Monitor vendor channels for updates and apply patches promptly once released.