A critical authorization bypass exists in phpVMS prior to version 7.0.6 that allows any unauthenticated user to invoke a legacy import process. This process is capable of overwriting or deleting the entire database, effectively erasing all flight, staff, and passenger records. The flaw stems from missing access controls, enabling attackers to execute privileged data‑management operations normally restricted to administrators.

The vulnerability affects installations of phpVMS version 7.0.5 and earlier, specifically the open‑source phpVMS application distributed under the vendor phpvms:phpvms. Any instance running an unsupported or older release is susceptible.

The CVSS score of 9.4 denotes critical severity. The EPSS score of 2% indicates a moderate probability of exploitation, while the vulnerability can be exploited remotely without authentication, granting full control over the database. The flaw is not currently listed in CISA KEV and no public exploits are documented, yet the lack of authentication and the destructive impact pose a high risk to any internet‑connected phpVMS deployment.