Easy!Appointments CVE-2026-23622

Exploitation requires an authenticated administrator to be logged into the Easy!Appointments instance and visit an attacker-controlled web page (UI:P in CVSS vector). The victim must have an active session cookie for the vulnerable application. No special application configuration is required - default installations of Easy!Appointments 1.5.2 and earlier are vulnerable. The attack is network-based (AV:N) with low complexity (AC:L) requiring no special privileges from the attacker's perspective (PR:N), though the victim must possess administrative privileges in the target application for the forged requests to succeed. The vulnerability is NOT exploitable through direct anonymous access; it requires social engineering to trick an authenticated admin into triggering the malicious requests. Same-origin policy does not prevent this attack because the forged requests originate from the victim's browser with valid session credentials. Browser-based CSRF defenses (SameSite cookies) would limit exploitation if configured, but default PHP session configurations do not enable these protections.

The CVSS 4.0 score of 7.4 with vector AV:N/AC:L/AT:N/PR:N/UI:P indicates network-accessible attacks with low complexity requiring only user interaction (victim must click a link or visit a page). The E:P (Proof-of-concept) modifier confirms exploit code availability via GitHub Security Advisory. However, EPSS probability of 0.01% (1st percentile) suggests minimal observed exploitation attempts in the wild, and absence from CISA KEV confirms no widespread or targeted campaigns detected by government agencies. This presents a risk paradox: the technical severity is high (admin takeover via simple GET request), publicly documented exploit exists, but real-world exploitation appears minimal. This likely reflects limited deployment scale of self-hosted appointment schedulers compared to enterprise software. For organizations running Easy!Appointments, risk is CRITICAL due to trivial exploitation (craft malicious URL, social engineer admin click) and catastrophic impact (full admin compromise). For threat prioritization across broader infrastructure, other vulnerabilities with KEV status or higher EPSS warrant priority unless Easy!Appointments is business-critical.

An attacker identifies an organization using Easy!Appointments by fingerprinting the application interface or subdomain naming patterns (e.g., appointments.company.com). The attacker crafts a malicious HTML page containing hidden image tags or JavaScript that triggers GET requests to administrative endpoints: <img src='https://appointments.company.com/index.php/backend_api/ajax_save_admin?username=attacker&password=Password123&email=attacker@evil.com'/>. The attacker then sends a phishing email to the organization's legitimate administrator with a pretext (e.g., 'Review our new partnership proposal') linking to the malicious page. When the administrator clicks while authenticated to Easy!Appointments, their browser automatically issues the GET requests, creating a new admin account under attacker control, enabling full system compromise including access to customer appointment data and business operations.