CVE-2026-108758: Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No prior account, appointment-management hash, or user interaction is required.
What must an attacker know to take over an appointment?
The attacker needs an appointment ID. Because appointment IDs can be enumerated sequentially, attackers can try IDs to locate and modify appointments.
What can an attacker do after exploiting the bypass?
An attacker can rewrite appointment details, associate an appointment with an attacker-controlled customer, and obtain management hashes. Those hashes can then be used to reschedule or cancel the affected appointment.
Which versions are known to be affected?
Easy!Appointments through version 1.6.0 is affected.