Findings

Category, severity, status and timeline are public. Technical details and vendor names follow only after the fix.

PSR-2026-001

Capacity-limit bypass in an online booking system

An online booking system does not fully enforce the capacity of a time slot. As a result, an already fully booked slot can be booked again without authentication (overbooking). Reported via Patchstack, where the same issue had already been reported earlier (duplicate). Technical details will follow once a fix is available.

Broken access control · via Patchstack

Medium Reported

Vendor or researcher?

We disclose vulnerabilities responsibly and are happy to hear from you.

Get in touch