CVE-2026-46688
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Meeting Room Booking System (MRBS) prior to version 1.12.2 contains an open redirect vulnerability that allows an unauthenticated attacker to redirect users to an arbitrary location after clicking a specially crafted URL. Version 1.12.2 contains a fix.
Risk Assessment
An attacker can exploit this vulnerability for phishing, redirecting users to fake login pages, potentially leading to credential theft.
Recommendation
Update MRBS to version 1.12.2 or later as soon as possible and educate users about clicking suspicious links.
Original NVD description (English source)
The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that will cause the user who clicks it to be redirected to the attacker-specified redirect URL, which could be a spoofed MRBS login page, for example. Version 1.12.2 contains a fix. No known workarounds are available.