CVE-2026-78258: CWE-862 Missing Authorization in Magepeople inc. Booking and Rental Manager

This vulnerability (CWE-862) in Booking and Rental Manager versions <= 2.7.5 allows unauthenticated users to bypass access controls, resulting in unauthorized access to certain resources or functions. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact without affecting integrity or availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

An attacker without authentication can access resources or perform actions that should be restricted, potentially exposing sensitive information. The impact is limited to confidentiality loss; integrity and availability are unaffected. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for unusual access patterns. Avoid exposing the application to untrusted networks if possible.