EUVD-2026-23434Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was detected in arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. The impacted element is an unknown function of the file /api/health/detailed of the component Health Check Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
The Hotel Booking Management System by arnobt78 (up to commit f8922d0e0f6ac1cc761974c7616f44c2bbc04bea) exposes sensitive information through an unauthenticated network request to the /api/health/detailed endpoint, allowing remote attackers to disclose system details without authentication or user interaction. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts.
Technical ContextAI
The vulnerability resides in the Health Check Endpoint handler for the /api/health/detailed API route within the Hotel Booking Management System. The underlying issue is a CWE-200 Information Exposure weakness, where the endpoint returns detailed system or application metadata that should not be accessible to unauthenticated users. Health check endpoints are commonly implemented to monitor service availability but may inadvertently leak configuration, version, or dependency information when not properly restricted. The affected product (CPE: cpe:2.3:a:arnobt78:hotel_booking_management_system:*:*:*:*:*:*:*:*) uses a rolling release delivery model without discrete version tags, making affected release identification difficult. The CVSS 4.0 vector shows network-accessible attack surface (AV:N), low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N), with confirmed low confidentiality impact (VC:L). The presence of exploit evidence indicator (E:P) confirms public proof-of-concept availability.
RemediationAI
No vendor-released patch or fixed version is available at time of analysis due to the vendor's lack of response to disclosure. Immediate mitigation requires restricting network access to the /api/health/detailed endpoint: implement firewall rules or reverse-proxy authentication to block unauthenticated access from untrusted networks, allowing only internal monitoring systems or specific IP ranges to query the endpoint. If the endpoint must remain publicly accessible, configure API response filtering to exclude sensitive fields (hostnames, versions, internal IPs) and return only generic health status ('ok'/'fail'). Apply request-level authentication via API key, OAuth, or JWT token validation on all /api/health/* paths. Monitor access logs for anomalous queries to this endpoint. Long-term remediation requires contacting the vendor (arnobt78) or forking the project to apply custom fixes, as the primary developer has not engaged with the disclosure. Organizations should also audit other API endpoints for similar information disclosure patterns. Detailed PoC and mitigation guidance is available at https://github.com/sudo-secure/security-research/blob/main/Hotel-Booking-Management-System/sensitive-information-disclosure/PoC.md.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today