Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| alextselegidis | easyappointments | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 11 Oct 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation. | |
| Title | Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint | |
| First Time appeared |
Easyappointments
Easyappointments easyappointments |
|
| Weaknesses | CWE-639 | |
| CPEs | cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Easyappointments
Easyappointments easyappointments |
|
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-11T12:19:55.847Z
Reserved: 2026-10-11T01:57:28.052Z
Link: CVE-2026-108758
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.