Easy!Appointments: Authorization bypass in Booking::register()
Summary
Easy!Appointments up to and including 1.6.0 contains an authorization bypass in the booking registration endpoint (Booking::register()). An unauthenticated attacker who supplies an appointment ID without its hash can modify any appointment, enumerating sequential IDs with a self-asserted manage_mode flag. This allows rewriting appointment details, rebinding appointments to attacker-controlled customers, and obtaining management hashes to reschedule or cancel appointments.
Affected
- Easy!Appointments versions 0 to 1.6.0 (per CNA record)
- Default configuration status: unaffected (per CNA record)
Fixed in
Unknown. No vendor advisory confirming a fixed version was found. Do not assume 1.6.0 is fixed; it is the last affected version.
Workaround
Unknown. No vendor workaround has been published.
Exploitation
- CISA SSVC: proof-of-concept exploitation exists, automatable: yes, technical impact: partial
- Not known to be exploited in the wild
Our recommendation
- Check whether an Easy!Appointments instance up to 1.6.0 is in use, and restrict internet access to the booking system or place it behind access controls
- Review appointment records for unexpected changes, such as reassigned customers or altered times
- Take a database backup before upgrading
- Upgrade only to a release confirmed by the vendor to contain the fix, and verify it against the referenced commit
- Monitor the upstream project for vendor advisories
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Easy!Appointments GitHub repository github.com
- Booking.php at vulnerable commit github.com
- Referenced patch commit github.com
- HackMD write-up: booking register appointment takeover hackmd.io
- VulnCheck advisory www.vulncheck.com
- Vulners CVE record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:34.
Original description (NVD)
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
NVD references (6)
- https://github.com/alextselegidis/easyappointments
- https://github.com/alextselegidis/easyappointments/blob/4bc7ecd51f3dade8e041558f2c23dda65bd6c43e/application/…
- https://github.com/alextselegidis/easyappointments/commit/09c6fb30b6aac0830a820d6bec3d2eb241daf150
- https://hackmd.io/@haind/easyappointments-booking-register-appointment-takeover
- https://www.vulncheck.com/advisories/easy-appointments-through-1.6.0-authorization-bypass-via-booking-registe…
- https://hackmd.io/@haind/easyappointments-booking-register-appointment-takeover
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.