This vulnerability exists in the arnobt78 Hotel Booking Management System up to commit f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. It involves an information disclosure flaw in the /api/health/detailed endpoint of the Health Check component. Remote attackers can exploit this flaw without authentication or user interaction to disclose information. The vendor has not provided any response or patch, and due to the rolling release nature of the product, no specific fixed versions are identified. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

Successful exploitation results in unauthorized information disclosure via the health check endpoint. This could potentially expose sensitive system or application details to remote attackers. There is no indication of privilege escalation, integrity, or availability impact. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor. Until a patch is released, consider restricting access to the /api/health/detailed endpoint to trusted internal networks or authenticated users if possible.