CVE-2026-73347

Unauthenticated privilege escalation vulnerability in TrueBooker versions up to and including 1.2.6. An attacker without logging in can elevate privileges, e.g., to administrator level.

Risk includes full application takeover, access to sensitive data, and modification of settings. The attack can be performed remotely without any credentials.

Immediately update TrueBooker to a version newer than 1.2.6. Restrict access to the application and monitor user activity.