CVE-2026-23622: fallo de gravedad alta en alextselegidis easyappointments
CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.4epss 0.2%
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
alextselegidis · easyappointmentsCVEs relacionadas — alextselegidis easyappointments
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-52837MEDIUMEasy!Appointments has unauthenticated customer PII disclosure on booking reschedule pageEPSS 0.5%CVE-2026-108758HIGHEasy!Appointments through 1.6.0 Authorization Bypass via booking/register EndpointEPSS 0.3%CVE-2026-52840LOWEasy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal networkEPSS 0.2%CVE-2026-55651HIGHEasy!Appointments Vulnerable to Appointments Takeover via Excessive Data ExposureEPSS 0.2%CVE-2026-52838LOWEasy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSSEPSS 0.2%CVE-2026-52841LOWEasy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google syncEPSS 0.2%