Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Booking and Rental Manager lets anyone modify bookings

CVE-2026-78258 · published 2 months ago
Summary

Versions of Booking and Rental Manager up to 2.7.5 do not properly verify who is making requests, so anyone on the internet can view or change booking and rental information. This could let malicious users alter reservations, steal data, or disrupt operations. Upgrade to the latest version or apply the vendor's security update as soon as possible.

What to do
  • Update magepeople inc. booking and rental manager to version 2.7.6.
Affected software
VendorProductAffected versions
magepeople inc. booking and rental manager <= 2.7.5
Fix: upgrade to 2.7.6
Original advisory text
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published24 Aug 2026
Updated4 Nov 2026
First seen24 Aug 2026
Sources
CVE-2026-78258 · NVD
CVE-2026-78258 · MITRE
Track software like this
Free during beta