This vulnerability in Webba Booking (<= 6.5.0) allows an attacker with low privileges to bypass authorization controls by manipulating user-controlled keys, leading to insecure direct object references (IDOR). This could allow unauthorized access to subscriber data or resources. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, and no integrity or availability impact.

An attacker with low privileges can exploit this vulnerability to gain unauthorized read access to subscriber data or resources within Webba Booking. The impact is limited to confidentiality with no integrity or availability effects reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users and monitor for suspicious activity related to authorization bypass attempts.