CVE-2026-52699 describes an authorization bypass vulnerability (CWE-639) in VikRentCar software versions up to 1.4.5. The issue arises from insecure direct object references that can be exploited without authentication by manipulating user-controlled keys. This allows attackers to access sensitive information, impacting confidentiality. The vulnerability has a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is remotely exploitable with low attack complexity and no privileges or user interaction required. No vendor patch or official remediation has been published yet.

The vulnerability allows unauthenticated attackers to bypass authorization controls and access sensitive data within VikRentCar, compromising confidentiality. There is no impact on integrity or availability. The attack can be performed remotely without any privileges or user interaction, making it a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to VikRentCar installations and monitor for unusual access patterns related to object references. Avoid exposing the application to untrusted networks if possible.