CVE-2026-109525: Missing Authorization in girishsaraf Online-Appointment-Booking-System

This vulnerability in girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 allows remote attackers to bypass authorization controls by manipulating the username[], timestamp[], and status[] arguments in the changebookingstatus.php file within the submit2 Handler component. The product's rolling release model means no explicit versioning information is provided for affected or patched releases. The issue was reported early to the project, but no response or fix has been published. Exploit code is publicly available.

An attacker can remotely exploit this vulnerability to perform unauthorized actions related to booking status changes by manipulating specific parameters. This could lead to unauthorized modification of appointment statuses, potentially disrupting service integrity. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

No official fix or patch has been released by the vendor as of the latest information. Users should monitor the vendor's communications for updates. In the meantime, restricting access to the affected endpoint and implementing additional authorization checks at the application or network level may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.