A critical authorization bypass exists in phpVMS prior to version 7.0.6 that allows any unauthenticated user to invoke a legacy import process. This process is capable of overwriting or deleting the entire database, effectively erasing all flight, staff, and passenger records. The flaw stems from missing access controls, enabling attackers to execute privileged data‑management operations normally restricted to administrators.

The vulnerability affects installations of phpVMS version 7.0.5 and earlier, specifically the open‑source phpVMS application distributed under the vendor phpvms: older release is susceptible.

The CVSS score of 9.4 denotes critical severity. The EPSS score of 1% indicates a low probability of exploitation, while the vulnerability can be exploited remotely without authentication, granting full control over the database. The flaw is not currently listed in CISA KEV, and the publicly available information does not specify whether public exploits have been released. Nevertheless, the lack of authentication and the destructive impact pose a high risk to any internet‑connected phpVMS deployment.