CVE-2026-57660 describes an unauthenticated broken access control vulnerability (CWE-862) in magepeopleteam's Booking and Rental Manager product, affecting versions up to and including 2.7.1. This flaw allows attackers without any privileges to bypass authorization controls, potentially enabling unauthorized modification or manipulation of data. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact. No patch or official remediation level has been published as of the vulnerability disclosure date.

The vulnerability allows unauthenticated attackers to bypass access control mechanisms, potentially leading to unauthorized modification of data within the affected Booking and Rental Manager software. There is no impact on confidentiality or availability. The integrity impact is low, meaning attackers may alter data or state in a limited manner. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Booking and Rental Manager instances to trusted users and networks only. Monitor vendor communications for updates on patches or mitigations.