CVE-2026-6492

CVE-2026-6492 is an information disclosure vulnerability affecting the arnobt78 Hotel Booking Management System up to commit f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. The flaw exists in an unknown function within the /api/health/detailed Health Check Endpoint, allowing attackers to access sensitive information through remote manipulation of the component. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) with a network-based attack vector requiring no authentication or user interaction. The attack complexity is low, meaning exploitation can be executed with minimal effort. While the impact is limited to confidentiality breaches with no integrity or availability concerns, the flaw remains exploitable by any unauthenticated remote attacker. Exploit code is currently available in the public domain, increasing the practical risk of active exploitation. The vulnerability is listed on the active Hot List and represents a known exploitable weakness. However, the EPSS score of 0.000390000 and lack of KEV designation suggest lower real-world exploitation activity compared to industry baselines. The vendor's unresponsiveness to early disclosure notifications limits remediation prospects for affected deployments.