oretnom23 php-travel-agency-system: Authentication bypass via user_id manipulation (CVE-2026-114439)

CVE-2026-114439 affects the php-travel-agency-system component responsible for session handling. The vulnerability exists in 'admin/session.php', where insufficient validation of the 'user_id' argument allows an attacker to bypass authentication mechanisms. The project follows a rolling release model, and no specific patch or fixed version is currently available. The maintainers have been notified but have not provided a response or a resolution.

Impact

Successful exploitation allows a remote, unauthenticated attacker to bypass authentication controls and potentially gain administrative access to the travel agency system.

Recommendation

• Inventory all instances of 'php-travel-agency-system' within your environment.
• Restrict access to the 'admin/' directory to known, trusted IP addresses via web application firewall or network-level access controls until a security update is provided by the vendor.
• Implement request logging for all calls to 'admin/session.php' to identify potential exploitation attempts characterized by non-standard 'user_id' parameters.
• If the application is not business-critical, disable it until the vulnerability is addressed by the maintainer.