This vulnerability (CVE-2026-97251) involves an authorization bypass through insecure direct object references (IDOR) in the Bus Ticket Booking with Seat Reservation product by magepeopleteam. Specifically, unauthenticated users can manipulate user-controlled keys to access or modify resources they should not be authorized to. The affected versions are all versions up to and including 5.9.3. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but integrity and availability impacts are low.

The vulnerability allows unauthenticated attackers to bypass authorization controls, potentially leading to unauthorized modification of data (integrity impact) and disruption of service (availability impact). There is no confidentiality impact reported. The medium severity score reflects these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor magepeopleteam communications for updates. Until a fix is available, restricting access to the affected application and implementing compensating controls to validate user authorization may help mitigate risk.