CVE-2026-96461

Summary

The TMS Amelia booking system has a missing authorization flaw that allows attackers to exploit incorrectly configured access control levels, potentially enabling unauthorized access to booking data and functionality. This vulnerability affects versions through 2.4.10 and represents a significant security gap in the application's permission model.

Exploitability

Exploitation is relatively straightforward with no special preconditions required, as the vulnerability allows unauthorized users to bypass access controls and perform actions they shouldn't be able to, making it a high-value target for attackers seeking to manipulate booking data.

Blast radius

If exploited, this vulnerability could allow attackers to manipulate booking records, potentially leading to revenue loss, data corruption, or unauthorized access to sensitive customer information across the affected TMS Amelia system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.4.11 or later to address the missing authorization controls and correct the incorrectly configured access control security levels.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.