CVE-2026-94229: TrueBooker 1.1.9 to before 1.3.0

CVE-2026-94229. CVSS 3.1 base score 5.3 (MEDIUM, Vendor/CNA).

Affected technology

TrueBooker · 1.1.9 to before 1.3.0
Vendor not specified by the source

Description’s affected range: before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attackers can enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link. Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.

Published 19-Oct-2026 08:52 UTC

CCR priority: 21.2 /100 (P4)
CVSS 3.1: 5.3 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · Vendor/CNA
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-19 08:52:30.827432+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-94229.html