Easy!Appointments is a self-hosted appointment scheduler where provider isolation is an intended security boundary. Versions before 1.6.0 properly filter provider-scoped appointments in search responses but fail to verify that the user-controlled 'id_users_provider' field in 'appointments/store' and 'appointments/update' endpoints belongs to the current authenticated provider session. This lack of verification enables an authenticated provider to inject new appointments into another provider's schedule or reassign existing appointments to a foreign provider's calendar. Additionally, the 'store' endpoint commits unauthorized rows before crashing due to a type error, resulting in persisted unauthorized data despite an error response. Version 1.6.0 addresses this vulnerability.

An authenticated provider can bypass authorization controls to create or modify appointments in other providers' schedules. This can lead to unauthorized data manipulation and potential disruption of appointment management. The vulnerability has a low CVSS score (3.3) reflecting limited impact on confidentiality and integrity and no impact on availability. There are no known exploits in the wild.

Upgrade to Easy!Appointments version 1.6.0 or later, where this authorization bypass vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed in the advisory, but the vendor states version 1.6.0 patches the issue.