CVE-2026-108758highCWE-639

CVE-2026-108758: falha de alta gravidade em alextselegidis easyappointments

Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar easyappointments

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.3%
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
alextselegidis · easyappointments
CVEs relacionadas — alextselegidis easyappointments

No mesmo produto, das mais perigosas para as menos.

CVE-2026-52837MEDIUMEasy!Appointments has unauthenticated customer PII disclosure on booking reschedule pageEPSS 0.5%CVE-2026-52840LOWEasy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal networkEPSS 0.2%CVE-2026-23622HIGHCSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeoverEPSS 0.2%CVE-2026-55651HIGHEasy!Appointments Vulnerable to Appointments Takeover via Excessive Data ExposureEPSS 0.2%CVE-2026-52838LOWEasy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSSEPSS 0.2%CVE-2026-52841LOWEasy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google syncEPSS 0.2%