CVE-2026-114439
A vulnerability was determined in oretnom23 php-travel-agency-system
- Risk score
- 68/100
- CVSS
- 7.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in the Session Handler component of the php-travel-agency-system allows an attacker to bypass authentication by manipulating the user_id argument, which can be done remotely.
- Affected
- php-travel-agency-system (no specific version details available due to rolling releases)
- Fix
- Check the linked advisory for further information as the project has not responded to the issue report
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 7.3 high
- Remotely exploitable without logging in
- On your watchlist: php
References
Original description
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Last activity 21 Oct 2026. Patch Forecast updates every hour.