GHSA-4vmm CVE-2026-55551 预约接管过度数据暴露漏洞

漏洞概述 漏洞名称: Appointments Takeover via Excessive Data Exposure 漏洞编号: GHSA-4vmm-5qvc-w5p7 严重程度: 高（7.1 / 10） CVE ID: CVE-2026-55551 CVSS v3 base metrics: Attack vector: Network Attack complexity: Low Privileges required: Low User interaction: None Scope: Unchanged Confidentiality: Low Integrity: High Availability: None 描述: Summary: 在customers search端点中存在一个过度数据暴露漏洞，允许经过身份验证的用户获取属于其他用户的预约哈希。使用这些哈希，攻击者可以修改或删除其他提供者的预约，导致预约接管。 Details: customers search端点向任何经过身份验证的用户暴露了过多的信息，包括不属于搜索用户的预约哈希。这些哈希唯一标识不属于搜索用户的预约。通过重用获得的哈希，攻击者可以与预约管理端点交互，允许修改或删除第三方预约。缺乏对象级授权控制导致预约接管，影响数据机密性和完整性。 Impact: 此漏洞允许经过身份验证的用户接管属于其他用户的预约。通过获取和重用暴露的哈希，攻击者可以查看、修改或删除其他提供者的预约，损害数据完整性和机密性。这可能导致未经授权的预约取消或修改，服务中断。 影响范围 受影响版本: >= 1.5.2 修复版本: 1.6.0 修复方案 Recommendation: 在发出POST请求到 端点时，仅返回属于发送请求的提供者的预约。这样，提供者无法访问随机哈希，无法执行接管。 POC代码 1. 查看预约: - 使用提供者“Jane Doe”查看预约。 2. 提取哈希: - 使用提供者“test test”发送请求到 ，验证客户“Joe Shmo”在列表中。响应返回过多数据，可以提取与用户Jane Doe关联的预约哈希。 3. 检查预约信息: - 使用哈希访问 端点，提供者“test test”，检查预约信息。 4. 更改提供者: - 将提供者更改为“test test”，可以更改预约提供者。 5. 保存预约: - 保存后，预约现在在“test test”提供者下，从“John Doe”提供者日历中消失。 6. 取消/删除预约: - 接管预约后，可以取消/删除预约。 ```http POST /calendar/schedule/delete HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json X-CSRF-TOKEN: 92f7ff6a2d90 Origin: http://localhost Content-Length: 10 Connection: keep-alive Cookie: laravel_session=eyJpdiI6Ilp3Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2h6Z2

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

GHSA-4vmm CVE-2026-55551 预约接管过度数据暴露漏洞

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

GHSA-4vmm CVE-2026-55551 预约接管过度数据暴露漏洞

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！