Which versions of Easy!Appointments are affected by CVE-2026-23622?

Easy!Appointments versions 1.5.2 and earlier contain a CSRF vulnerability that allows attackers to manipulate authenticated administrators into performing critical actions such as creating admin…

Is there a public PoC exploit available for CVE-2026-23622?

Yes, a public proof-of-concept exploit is available for CVE-2026-23622. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23622?

Within 24 hours: Inventory all Easy!Appointments deployments and identify running versions; notify administrators to avoid clicking external links while authenticated. Within 7 days: Upgrade to the latest available version of Easy!Appointments or apply any available security patches from the vendor; if unavailable, implement network-level CSRF protections (SameSite cookie policies, WAF rules). Within 30 days: Conduct administrator awareness training on CSRF attacks and phishing; implement multi-factor authentication for admin accounts; review admin account creation logs for unauthorized changes.

Easy!Appointments CVE-2026-23622

Q: What is the CVSS score of CVE-2026-23622?

CVE-2026-23622 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-01-15 security-advisories@github.com

GHSA-54v4-4685-vwrj

PHP CSRF Easyappointments Easy Appointments

7.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 29, 2026 - 01:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 29, 2026 - 01:11 vuln.today

cvss_changed

CVSS changed

Apr 29, 2026 - 01:11 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 28, 2026 - 17:33 vuln.today

Public exploit code

CVE Published

Jan 15, 2026 - 20:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Easy!Appointments 1.5.2 and earlier allows remote attackers to perform administrative actions including admin account creation, credential modification, and full account takeover by tricking authenticated administrators into visiting a malicious page. The vulnerability stems from incomplete CSRF protection that only validates POST requests while state-changing operations accept GET parameters. A publicly available exploit exists (GitHub Security Advisory GHSA-54v4-4685-vwrj), though EPSS exploitation probability is low (0.01%, 1st percentile) and the vulnerability is not listed in CISA KEV, suggesting limited real-world exploitation to date.

Technical ContextAI

Easy!Appointments is a PHP-based self-hosted appointment scheduling application. The vulnerability (CWE-352: Cross-Site Request Forgery) exists in the application/core/EA_Security.php file where the csrf_verify() function only enforces anti-CSRF token validation for POST requests and returns early for GET and other HTTP methods. However, multiple administrative endpoints accept parameters via $_REQUEST or GET methods while performing security-critical state changes. This architectural flaw creates a classic CSRF vulnerability where attackers can construct malicious URLs that, when visited by an authenticated administrator, execute privileged operations without the victim's knowledge or consent. The affected product (CPE: cpe:2.3:a:easyappointments:easy!appointments:*:*:*:*:*:-:*:*) is a standalone PHP application, making all self-hosted instances through version 1.5.2 vulnerable.

RemediationAI

Upgrade to Easy!Appointments version 1.5.3 or later where CSRF protection has been extended to all HTTP methods and GET-based state-changing endpoints have been migrated to POST-only operations. The vendor advisory and fix details are available at https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj. If immediate patching is not feasible, implement compensating controls: (1) Configure web application firewall (WAF) rules to block suspicious GET requests to administrative endpoints (/index.php/backend_api/ajax_save_*, /admin/*) from external referrers, though this may break legitimate deep-linking workflows; (2) Require re-authentication (password confirmation) for critical administrative actions like account creation and password changes via application code modification, adding operational friction for administrators; (3) Deploy browser-based defenses by setting SameSite=Strict cookie attributes for session cookies, though this breaks cross-site legitimate workflows and requires PHP session configuration changes; (4) Implement network-level access controls restricting administrative interface access to trusted IP ranges or VPN-only access, reducing attack surface but limiting remote administration capabilities.