CVE-2026-108758: alextselegidis easyappointments

Vulnerability summary

CVE-2026-108758 is a high (CVSS 8.8) vulnerability in alextselegidis easyappointments. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17% of scored vulnerabilities.

Timeline

1. 11-10-2026
   PublishedVulnerability first disclosed.
2. 13-10-2026
   Last modifiedVulnerability information updated.

Description

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.