CVE-2026-108758— Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
Quick assessment
Affected
alextselegidis easyappointments
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Easy!Appointments 1.6.0 及之前版本中存在一个授权绕过漏洞，位于 函数中。该漏洞允许未经身份验证的攻击者通过提供不带哈希值的预约 ID 来修改任意预约。攻击者可以使用自声明的 标志枚举连续的预约 ID，从而重写预约详情，将预约重新绑定到由攻击者控制的客户，并获取用于重新安排或取消预约的管理哈希值。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| alextselegidis | easyappointments | ≤ 1.6.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108758
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| alextselegidis | easyappointments | 0 ~ 1.6.0 | - |
|
II. Public POCs for CVE-2026-108758
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108758
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108758 (1)
Vendor Advisories for CVE-2026-108758 (1)
Security Blog Posts for CVE-2026-108758 (1)
Vendor Pages for CVE-2026-108758 (1)
IV. Related Vulnerabilities
Same product: easyappointments
-
CVE-2026-55651
Easy!Appointments Vulnerable to Appointments Takeover via Ex -
CVE-2026-52841
Easy!Appointments: Authorization bypass in Google OAuth prov -
CVE-2026-52840
Easy!Appointments has server-side request forgery in CalDAV -
CVE-2026-52839
Easy!Appointments appointments/store and appointments/update -
CVE-2026-52838
Easy!Appointments disable_booking_message rendered as raw HT
Same vendor: alextselegidis
-
CVE-2026-73529
Plainpad Missing Rate Limiting via POST /v1/sessions -
CVE-2026-55651
Easy!Appointments Vulnerable to Appointments Takeover via Ex -
CVE-2026-52841
Easy!Appointments: Authorization bypass in Google OAuth prov -
CVE-2026-52840
Easy!Appointments has server-side request forgery in CalDAV -
CVE-2026-52839
Easy!Appointments appointments/store and appointments/update
Same weakness: CWE-639
-
CVE-2026-105411
Authorization Bypass Through User-Controlled Key vulnerabili -
CVE-2026-107427
WordPress Event post plugin <= 6.1.1 - Insecure Direct Objec -
CVE-2026-107193
Foreman: api filter lookup ignores a search-limited filter p -
CVE-2026-108797
ZKTeco BioTime Employee REST API employees authorization -
CVE-2026-108796
ZKTeco BioTime Biometric Data Endpoint finger_data authoriza
V. Comments for CVE-2026-108758
No comments yet