The vulnerability resides in an undisclosed function within the file /api/health/detailed of the Health Check Endpoint, allowing an attacker to receive sensitive system information. The weakness, identified as information disclosure, permits an attacker to learn details that could aid further intrusion. This flaw operates with remote exploitation capabilities, meaning a threat actor can trigger it from outside the network without additional footholds.

The affected product is arnobt78 Hotel Booking Management System. Versioning follows a rolling release model, and the exact versions affected are not enumerated. The vulnerability was found in functionality prior to the commit f8922d0e0f6ac1cc761974c7616f44c2bbc04bea.

The severity is scored as 6.9 on the CVSS scale, indicating a moderate to high risk. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, but the vulnerability is publicly documented and does not appear in the CISA KEV catalog. Based on the description, the likely attack vector is remote, and exploitation requires only that the actor can send a request to the /api/health/detailed endpoint, which may be unauthenticated or protected by weak access controls.