CVE-2026-57746 is a broken access control vulnerability (CWE-862) affecting ThemeREX Booked versions up to and including 3.0.0. The flaw allows subscriber-level users to bypass authorization restrictions, potentially leading to unauthorized access to sensitive information (high confidentiality impact) while only limited integrity impact is noted. The vulnerability does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the subscriber level, no user interaction needed, and unchanged scope. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation can lead to unauthorized access to sensitive data due to missing authorization checks. Confidentiality is highly impacted, while integrity is only slightly affected. There is no impact on availability. The vulnerability requires an attacker to have subscriber-level privileges and can be exploited remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for suspicious activity related to unauthorized access attempts. Avoid granting unnecessary subscriber-level access to untrusted users.