CVE-2026-16737

This vulnerability presents a compound risk that CVSS alone understates. The same insecure direct object reference (IDOR) that lets an attacker read any customer's booking and billing data also allows them to write to that record — you aren't looking at separate bugs, but one authorization failure with dual impact. An attacker can identify high-value bookings (large prepaid group trips, corporate accounts) and both harvest the stored billing information and inject their own data into the record, disrupting service or corrupting downstream accounting. The unauthenticated attack surface is critical here. No credential barrier exists — the attacker needs only a valid booking ID, which is trivially discoverable through sequential or randomized enumeration across the customer base. This makes the vulnerability trivially scalable regardless of EPSS scoring, which appears calibrated for low-demand targets but doesn't account for the compound effect of read-plus-write access on every customer record. What to verify and do now: Audit any AJAX or API endpoints that accept object identifiers (booking IDs, order IDs, customer IDs) from client requests and return data without explicit ownership verification. The fix in version 6.8.5 should show whether the developer added session binding, cookie-bound tokens, or database-level ownership checks — examine the diff to confirm it addresses both read and write vectors. If you're on an earlier version, treat this as a high-priority patch regardless of the CVSS 5.3 rating. Additionally, determine whether the stored billing data constitutes cardholder data or financial records under PCI-DSS; if so, the disclosure may trigger reporting obligations even without confirmed card data exposure.

Reviewed through automated stages and approved by a human before publication.