CVE-2026-28186

HighCVSS 8.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

Travelfic Toolkit plugin versions up to 1.5.1 contain a Broken Access Control vulnerability from subscriber level. A user with subscriber role can gain unauthorized privileges.

Risk Assessment

The risk includes privilege escalation by a subscriber, potentially leading to unauthorized changes in the system.

Recommendation

Update the Travelfic Toolkit plugin to the latest version that fixes the access control issue.

Original NVD description (English source)

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.