CVE-2026-28188

HighCVSS 7.3

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

Hydra Booking plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without authentication can exploit this flaw to perform unauthorized operations.

Risk Assessment

The risk includes unauthorized access to administrative functions or data, potentially leading to system integrity compromise.

Recommendation

Immediately update the Hydra Booking plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.