PatchSiren cyber security CVE debrief
CVE-2026-40774 SaasProject CVE debrief
CVE-2026-40774 is a HIGH severity vulnerability with a CVSS score of 7.5. It is an Unauthenticated Broken Access Control issue affecting Booking Package versions <= 1.7.06.
- Vendor
- SaasProject
- Product
- Booking Package
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-15
- Original CVE updated
- 2026-06-15
- Advisory published
- 2026-06-15
- Advisory updated
- 2026-06-15
Who should care
Users of Booking Package versions <= 1.7.06 should be aware of this vulnerability and take necessary actions to mitigate the risk.
Technical summary
The vulnerability has been described as CWE-862, indicating a lack of proper access control mechanisms. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating that the vulnerability can be exploited over the network with low attack complexity and no privileges required.
Defensive priority
HIGH
Recommended defensive actions
- Update Booking Package to a version greater than 1.7.06.
- Review and restrict access controls for the Booking Package plugin.
Evidence notes
Evidence suggests that this vulnerability was reported by Patchstack (see resourceLinkAnnotations 'ref-4').
Official resources
-
CVE-2026-40774 CVE record
CVE.org
-
CVE-2026-40774 NVD detail
NVD
-
Source item URL
nvd_modified
- Mitigation or vendor reference
CVE-2026-40774 was published on 2026-06-15T21:16:50.110Z and modified on 2026-06-15T21:24:32.790Z.