Easy!Appointments is a self-hosted appointment scheduler. In versions before 1.6.0, the application correctly filters provider-scoped appointments in search responses, indicating provider isolation as a security boundary. However, the direct mutation endpoints 'appointments/store' and 'appointments/update' only check generic appointment privileges without verifying that the 'id_users_provider' in the request belongs to the authenticated session. This allows an authenticated provider to inject new appointments into another provider's schedule or reassign existing appointments to a foreign provider's calendar. The 'store' endpoint also contains a bug where unauthorized database writes occur before a type error causes the controller to crash, resulting in the unauthorized appointment being persisted despite an error response. The issue is fixed in version 1.6.0.

An authenticated provider can bypass intended authorization controls to create or modify appointments in other providers' schedules. This leads to unauthorized data manipulation and potential disruption of appointment management. The vulnerability does not affect confidentiality or availability but impacts data integrity and authorization boundaries.

Upgrade to Easy!Appointments version 1.6.0 or later, where this authorization bypass vulnerability is fixed. No other mitigations are indicated in the vendor advisory. Patch status is not explicitly confirmed in the advisory, but version 1.6.0 is stated as the fixed version.