Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This… (CVE-2026-108477)

CVE-2026-108477 describes a missing authorization vulnerability in Arraytics Booktics up to version 1.0.28. The flaw arises from incorrectly configured access control security levels, allowing unauthorized users to perform actions that should be restricted. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 5.3, with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). There is no indication of known exploits in the wild or vendor-provided patches.

The vulnerability allows unauthorized modification of data or actions due to missing authorization checks, impacting data integrity. There is no impact on confidentiality or availability. Exploitation requires no privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting network access to the affected service and reviewing access control configurations may reduce risk.