CVE-2026-46688

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46688", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T21:46:51.548Z", "datePublished": "2026-08-12T23:30:25.563Z", "dateUpdated": "2026-08-13T13:11:21.589Z"}, "containers": {"cna": {"title": "Meeting Room Booking System has an unauthenticated open redirect", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-6xcj-g522-859f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-6xcj-g522-859f"}, {"name": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2"}], "affected": [{"vendor": "meeting-room-booking-system", "product": "mrbs-code", "versions": [{"version": "< 1.12.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T23:30:25.563Z"}, "descriptions": [{"lang": "en", "value": "The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that will cause the user who clicks it to be redirected to the attacker-specified redirect URL, which could be a spoofed MRBS login page, for example. Version 1.12.2 contains a fix. No known workarounds are available."}], "source": {"advisory": "GHSA-6xcj-g522-859f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T13:11:14.196139Z", "id": "CVE-2026-46688", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:11:21.589Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46688", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:11:14.196139Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:11:18.882Z"}}], "cna": {"title": "Meeting Room Booking System has an unauthenticated open redirect", "source": {"advisory": "GHSA-6xcj-g522-859f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "meeting-room-booking-system", "product": "mrbs-code", "versions": [{"status": "affected", "version": "< 1.12.2"}]}], "references": [{"url": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-6xcj-g522-859f", "name": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-6xcj-g522-859f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2", "name": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that will cause the user who clicks it to be redirected to the attacker-specified redirect URL, which could be a spoofed MRBS login page, for example. Version 1.12.2 contains a fix. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T23:30:25.563Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46688", "state": "PUBLISHED", "dateUpdated": "2026-08-13T13:11:21.589Z", "dateReserved": "2026-05-15T21:46:51.548Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-12T23:30:25.563Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mrbs-code", "vendor": "meeting-room-booking-system", "versions": [{"status": "affected", "version": "< 1.12.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that will cause the user who clicks it to be redirected to the attacker-specified redirect URL, which could be a spoofed MRBS login page, for example. Version 1.12.2 contains a fix. No known workarounds are available."}, {"lang": "es", "value": "El Sistema de Reserva de Salas de Reuniones (MRBS) es una aplicaci\u00f3n basada en PHP para reservar salas de reuniones. Antes de la versi\u00f3n 1.12.2, se pod\u00eda realizar una solicitud no autenticada para redirigir al usuario a una ubicaci\u00f3n especificada por la consulta. Esto permite a un atacante crear una URL especialmente dise\u00f1ada para una instalaci\u00f3n de MRBS que har\u00e1 que el usuario que haga clic en ella sea redirigido a la URL de redirecci\u00f3n especificada por el atacante, que podr\u00eda ser una p\u00e1gina de inicio de sesi\u00f3n de MRBS falsificada, por ejemplo. La versi\u00f3n 1.12.2 contiene una soluci\u00f3n. No se conocen soluciones alternativas disponibles."}], "id": "CVE-2026-46688", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46688", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T13:11:14.196139Z", "version": "2.0.3"}}]}, "published": "2026-08-13T00:17:32.250", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-6xcj-g522-859f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mrbs-code", "source": "cna", "vendor": "meeting-room-booking-system"}, "product": "mrbs-code", "vendor": "meeting-room-booking-system"}], "created": "2026-08-13T01:45:02.475267+00:00", "updated": "2026-08-13T09:47:26.666677+00:00", "vendors": ["meeting-room-booking-system", "meeting-room-booking-system$PRODUCT$mrbs-code"]}