CVE-2026-123128: GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition

Q: Who can exploit this issue?

Unauthenticated users can exploit it. They need to send simultaneous booking requests targeting the same team member through different bookable items.

Q: Are normal single booking requests affected?

The issue requires concurrent requests. A single booking request alone is not described as creating an overlapping booking.

Q: What is the impact of a successful exploit?

An attacker can create overlapping confirmed bookings for the same team member, causing that person to be double-booked across different bookable items.

Q: Which versions need attention?

GemBooking versions before 1.7.1 are affected. Updating to 1.7.1 or later addresses the described lack of per-team-member request serialization.

Published Nov 9, 2026

Updated

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.

Affected Software

1 affected component

GemBooking<1.7.1

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated users can exploit it. They need to send simultaneous booking requests targeting the same team member through different bookable items.

Are normal single booking requests affected?

The issue requires concurrent requests. A single booking request alone is not described as creating an overlapping booking.

What is the impact of a successful exploit?

An attacker can create overlapping confirmed bookings for the same team member, causing that person to be double-booked across different bookable items.

Which versions need attention?

GemBooking versions before 1.7.1 are affected. Updating to 1.7.1 or later addresses the described lack of per-team-member request serialization.

CVE-2026-123128: GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are normal single booking requests affected?

What is the impact of a successful exploit?

Which versions need attention?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are normal single booking requests affected?

What is the impact of a successful exploit?

Which versions need attention?