CVE-2026-115614

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 26, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-115624.3The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authentica CVE-2026-1156246.9GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user wi CVE-2026-1156276.0Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only t CVE-2026-115639.6The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have CVE-2026-1156356.0Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. W CVE-2026-1156384.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a CVE-2026-115649.1libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy CVE-2026-1156407.4LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist contr CVE-2026-1156428.3In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-CVE-2026-1156448.8Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a CVE-2026-1156469.8Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Ver CVE-2026-115658.5The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions,