php-travel-agency-system CVE-2026-114439

Requires network access to the admin/session.php endpoint of a deployed php-travel-agency-system instance; exploitation targets the Session Handler component by tampering with the user_id argument, and per CVSS PR:N/UI:N it needs no prior authentication and no user interaction. The primary limiting factor is exposure of the application's admin interface to the attacker (internet-facing or reachable internal network) - there is no indication a non-default configuration is required. The dominant practical constraint is the product's rarity: almost no production environments run this application. Because the vendor uses rolling releases with no version data and has not responded, defenders cannot pin exploitability to a specific version boundary.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially-reachable, remote, unauthenticated flaw, which normally signals high priority; however the realistic risk is tempered by several factors. VulDB scored vulnerable-system impact as only Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), and the E:P (Proof-of-Concept) exploit-maturity metric is consistent with the input signal that only POC code exists - this is NOT confirmed active exploitation. No CISA KEV listing and no EPSS score were provided, so widespread opportunistic exploitation cannot be asserted. The single most important risk-limiting factor is the product itself: oretnom23's php-travel-agency-system is a small open-source/educational PHP application (typical of Sourcecodester-style projects) with a negligible production footprint, so even a clean unauthenticated auth-bypass has little aggregate real-world exposure. There is also a latent conflict worth flagging: CWE-306 (Missing Authentication) applied to an admin Session Handler could plausibly yield full administrative compromise (which would justify High impact), yet the vendor-assigned vector rates impact only as Low - the vague description ('manipulation of argument user_id can lead to missing authentication') does not let us confirm whether the result is partial data exposure or full admin takeover. Net: a genuine, easily-exploitable bug, but low priority for most defenders due to minimal deployment and no evidence of active exploitation.

A remote, unauthenticated attacker sends a crafted request to admin/session.php manipulating the user_id argument to bypass the Session Handler's authentication check and obtain an authenticated/administrative session context. Publicly available proof-of-concept exploit code exists (referenced via the project's GitHub issue tracker), lowering the skill barrier. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation needs only network reachability to the admin endpoint with no credentials or user interaction.