CVE-2026-108758: Authorization Bypass Through User-Controlled Key in alextselegidis easyappointments

CVE-2026-108758 describes an authorization bypass vulnerability in Easy!Appointments through version 1.6.0. The vulnerability exists in the Booking::register() method, where the system relies on a hash to authorize modifications to appointments. However, attackers can bypass this check by supplying only the appointment ID without the hash, enabling them to enumerate sequential appointment IDs and modify any appointment's details. This includes rebinding appointments to attacker-controlled customers and retrieving management hashes that allow further unauthorized operations such as rescheduling or cancellation.

An unauthenticated attacker can modify any appointment in the system, potentially altering appointment details, reassigning appointments to unauthorized customers, and gaining management hashes that facilitate further unauthorized appointment management actions. This compromises the integrity and confidentiality of appointment data and could disrupt business operations relying on the scheduling system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the appointment management interface and monitor for suspicious activity related to appointment modifications. Avoid exposing sequential appointment IDs publicly to reduce the risk of enumeration.