Which versions of MRBS are affected by CVE-2026-46382?

The Meeting Room Booking System (MRBS) prior to version 1.12.2 contains a vulnerability that allows attackers to bypass authentication requirements and compromise the integrity of meeting room…

How to fix or mitigate CVE-2026-46382?

Within 24 hours, inventory all MRBS deployments to identify those running versions prior to 1.12.2 and document which instances are exposed to untrusted networks. Within 7 days, restrict network access to the import feature via firewall rules or require VPN authentication, or disable the import functionality entirely if not operationally required. Within 30 days, monitor MRBS release channels for availability of version 1.12.2, coordinate a phased upgrade strategy across all affected instances, and validate the upgrade addresses this vulnerability.

MRBS CVE-2026-46382

Q: What is the CVSS score of CVE-2026-46382?

CVE-2026-46382 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-13 security-advisories@github.com

SSRF

8.7

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

No privileges required for network-accessible import endpoint; SSRF induces scope change to internal systems; VC:N as responses appear unreflected to attacker.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 13, 2026 - 00:31 vuln.today

Analysis Generated

Aug 13, 2026 - 00:31 vuln.today

CVE Published

Aug 13, 2026 - 00:17 cve.org

HIGH 8.7

DescriptionCVE.org

The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available.

AnalysisAI

Server-Side Request Forgery in the Meeting Room Booking System (MRBS) import functionality allows remote attackers to force the application to fetch arbitrary private or local URIs, enabling potential pivot into internal networks or unauthorized integrity modification of internal services. The flaw affects all MRBS deployments prior to version 1.12.2, where the import feature accepts user-supplied URIs without restricting private address ranges or local endpoints. No public exploit code has been identified at time of analysis, but the unauthenticated network attack vector and low complexity make this trivially exploitable against internet-exposed instances.

Technical ContextAI

MRBS is an open-source PHP application for scheduling and booking meeting rooms. CWE-918 (Server-Side Request Forgery) arises when an application forwards user-controlled input to an internal HTTP client without validating the destination against an allowlist of permitted hosts or blocking private address space (RFC 1918 ranges, loopback, link-local). In this case, the import functionality accepts a user-supplied URI and fetches it server-side without such checks, enabling attackers to direct the server's outbound request to internal infrastructure. The codebase is published at github.com/meeting-room-booking-system/mrbs-code, and no CPE strings were included in the provided intelligence. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack surface is the network with no preconditions, and the VI:H metric indicates the primary risk is unauthorized integrity modification rather than data exfiltration, consistent with a blind or semi-blind SSRF where server responses are not fully reflected to the attacker.

Affected ProductsAI

MRBS (Meeting Room Booking System) all versions prior to 1.12.2 are affected. The vulnerability specifically resides in the import functionality. The vendor security advisory is published at https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-gh77-mpcm-f8r3, and the patched release is documented at https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2. No CPE strings were included in the provided intelligence data.

RemediationAI

Upgrade MRBS to version 1.12.2 immediately, as this is the only confirmed fix per the vendor release at https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2 and security advisory GHSA-gh77-mpcm-f8r3. The advisory explicitly states no known workarounds are available. If immediate upgrade is operationally blocked, implement network-level egress filtering on the MRBS application server to block outbound HTTP and HTTPS requests to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), link-local (169.254.0.0/16), and cloud instance metadata endpoints (169.254.169.254); note that egress filtering reduces pivot risk but does not eliminate the SSRF itself and may break legitimate import workflows. If the import feature is not in active use, restrict access to its endpoint at the web server layer via Apache or nginx ACL rules to reduce the attack surface; this has the trade-off of disabling the import feature entirely.