SZB-725ac29890
EUVD lists IDOR flaw in Nicdark Hotel Booking up to 3.8
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Nicdark
- Product
- Hotel Booking
- First seen
Summary
The EU Vulnerability Database (EUVD) lists an insecure direct object reference vulnerability in Hotel Booking versions up to 3.8 from Nicdark, scored 6.5/10 (CVSS v3.1). The entry was published 2026-10-29 and updated 2026-10-30, and the item reports no known exploitation.
If you use Nicdark
Update Hotel Booking to a version later than 3.8 when available
Check the EUVD entry EUVD-2026-113001 for patch status
Review booking records for access by unexpected accounts
What the sources say 1
· Mastodon: “Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.” Source