Capacity-limit bypass in an online booking system
An online booking system does not fully enforce the capacity of a time slot. As a result, an already fully booked slot can be booked again without authentication (overbooking). Reported via Patchstack, where the same issue had already been reported earlier (duplicate). Technical details will follow once a fix is available.
- Category
- Broken access control
- Product type
- Booking extension for a content management system
- Vendor
- not yet public
- Reported via
- Patchstack
- Status on the platform
- Duplicate
Timeline
- Reported21/10/2026
- Acknowledgedopen
- Fixedopen
- Disclosure19/01/2027
Technical details will be published once a fix is available, at the latest by the end of the disclosure period.