CVE-2026-108758 — Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplyin…
Published: 2026-10-11 · CVSS: 8.8 · CVSS 4.0
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7